Control: 2.12 Ensure that authorization for Docker client commands is enabled

Description

You should use native Docker authorization plugins or a third party authorization mechanism with the Docker daemon to manage access to Docker client commands.

Docker’s out-of-the-box authorization model is currently "all or nothing". This means that any user with permission to access the Docker daemon can run any Docker client command. The same is true for remote users accessing Docker’s API to contact the daemon. If you require greater access control, you can create authorization plugins and add them to your Docker daemon configuration. Using an authorization plugin, a Docker administrator can configure granular access policies for managing access to the Docker daemon.

Third party integrations of Docker may implement their own authorization models to require authorization with the Docker daemon outside of docker's native authorization plugin (i.e. Kubernetes, Cloud Foundry, Openshift).

Remediation

Step 1: Install/Create an authorization plugin. Step 2: Configure the authorization policy as desired. Step 3: Start the docker daemon as below:

dockerd --authorization-plugin=<PLUGIN_ID>

Default Value

By default, authorization plugins are not set up.

Usage

Run the control in your terminal:

powerpipe control run docker_compliance.control.cis_v160_2_12

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run docker_compliance.control.cis_v160_2_12 --share

SQL

This control uses a named query:

with os_output as (
  select
    btrim(stdout_output, E' \n\r\t') as os,
    _ctx ->> 'connection_name' as os_conn
  from
    exec_command
  where
    command = 'uname -s'
), hostname as (
  select
    btrim(stdout_output, E' \n\r\t') as host,
    _ctx ->> 'connection_name' as host_conn,
    _ctx
  from
    exec_command
  where
    command = 'hostname'
),

 command_output as (
  select
    stdout_output,
    _ctx ->> 'connection_name' as conn
  from
    exec_command,
    os_output
  where
     os_conn = _ctx ->> 'connection_name'
    and command = 'ps -ef | grep dockerd'
), linux_output as (
  select
    stdout_output,
    _ctx ->> 'connection_name' as conn
  from
    exec_command,
    os_output
  where
    os_conn = _ctx ->> 'connection_name'
    and command = 'cat /etc/docker/daemon.json'
)
select
  host as resource,
  case
    when os.os ilike '%Darwin%' then 'skip'
    when o.stdout_output like '%--authorization-plugin%' or j.stdout_output::jsonb -> 'authorization-plugins' is not null then 'ok'
    else 'alarm'
  end as status,
  case
    when os.os ilike '%Darwin%' then host || ' /etc/docker/daemon.json does not exist on ' || os.os || ' OS.'
    when o.stdout_output like '%--authorization-plugin%' or j.stdout_output::jsonb -> 'authorization-plugins' is not null then host || ' authorization for Docker client commands is enabled.'
    else host || ' authorization for Docker client commands is disabled.'
  end as reason
  , h._ctx ->> 'connection_name' as connection_name
from
  hostname as h,
  os_output as os,
  command_output as o,
  linux_output as j
where
  os.os_conn = h.host_conn
  and h.host_conn = o.conn
  and h.host_conn = j.conn

Control: 2.12 Ensure that authorization for Docker client commands is enabled

Description

Remediation

Default Value

Usage

SQL

Tags