turbot/steampipe-mod-docker-compliance

Control: 3.7 Ensure that registry certificate file ownership is set to root:root

Description

You should verify that all the registry certificate files (usually found under /etc/docker/certs.d/<registry-name> directory) are individually owned and group owned by root.

The /etc/docker/certs.d/<registry-name> directory contains Docker registry certificates. These certificate files must be individually owned and group owned by root to ensure that less privileged users are unable to modify the contents of the directory.

Remediation

The following command could be executed:

chown root:root /etc/docker/certs.d/<registry-name>/*

This would set the individual ownership and group ownership for the registry certificate files to root.

Default Value

By default, the individual ownership and group ownership for registry certificate files is correctly set to root.

Usage

Run the control in your terminal:

powerpipe control run docker_compliance.control.cis_v160_3_7

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run docker_compliance.control.cis_v160_3_7 --share

SQL

This control uses a named query:

with os_output as (
select
btrim(stdout_output, E' \n\r\t') as os,
_ctx ->> 'connection_name' as os_conn
from
exec_command
where
command = 'uname -s'
), hostname as (
select
btrim(stdout_output, E' \n\r\t') as host,
_ctx ->> 'connection_name' as host_conn,
_ctx
from
exec_command
where
command = 'hostname'
),
linux_output as (
select
stdout_output,
_ctx ->> 'connection_name' as conn
from
exec_command,
os_output
where
os_conn = _ctx ->> 'connection_name'
and command = 'stat -c %U:%G /etc/docker/certs.d/* | grep -v root:root'
)
select
host as resource,
case
when os.os ilike '%Darwin%' then 'skip'
when o.stdout_output = '' then 'ok'
else 'alarm'
end as status,
case
when os.os ilike '%Darwin%' then host || ' /etc/docker/certs.d does not exist on ' || os.os || ' OS.'
when o.stdout_output = '' then host || ' registry certificate file ownership is set to root:root.'
else host || ' registry certificate file ownership is not set to root:root.'
end as reason
, h._ctx ->> 'connection_name' as connection_name
from
hostname as h,
os_output as os,
linux_output as o
where
os.os_conn = h.host_conn
and h.host_conn = o.conn;

Tags