Control: 3.7 Ensure that registry certificate file ownership is set to root:root
Description
You should verify that all the registry certificate files (usually found under
/etc/docker/certs.d/<registry-name>
directory) are individually owned and group
owned by root
.
The /etc/docker/certs.d/<registry-name>
directory contains Docker registry
certificates. These certificate files must be individually owned and group owned by root
to ensure that less privileged users are unable to modify the contents of the directory.
Remediation
The following command could be executed:
chown root:root /etc/docker/certs.d/<registry-name>/*
This would set the individual ownership and group ownership for the registry certificate files to root
.
Default Value
By default, the individual ownership and group ownership for registry certificate files is
correctly set to root
.
Usage
Run the control in your terminal:
powerpipe control run docker_compliance.control.cis_v160_3_7
Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run docker_compliance.control.cis_v160_3_7 --share
SQL
This control uses a named query:
with os_output as ( select btrim(stdout_output, E' \n\r\t') as os, _ctx ->> 'connection_name' as os_conn from exec_command where command = 'uname -s'), hostname as ( select btrim(stdout_output, E' \n\r\t') as host, _ctx ->> 'connection_name' as host_conn, _ctx from exec_command where command = 'hostname'),
linux_output as ( select stdout_output, _ctx ->> 'connection_name' as conn from exec_command, os_output where os_conn = _ctx ->> 'connection_name' and command = 'stat -c %U:%G /etc/docker/certs.d/* | grep -v root:root')select host as resource, case when os.os ilike '%Darwin%' then 'skip' when o.stdout_output = '' then 'ok' else 'alarm' end as status, case when os.os ilike '%Darwin%' then host || ' /etc/docker/certs.d does not exist on ' || os.os || ' OS.' when o.stdout_output = '' then host || ' registry certificate file ownership is set to root:root.' else host || ' registry certificate file ownership is not set to root:root.' end as reason , h._ctx ->> 'connection_name' as connection_namefrom hostname as h, os_output as os, linux_output as owhere os.os_conn = h.host_conn and h.host_conn = o.conn;