Control: 5.31 Ensure that the host's user namespaces are not shared
Description
You should not share the host's user namespaces with containers running on it.
User namespaces ensure that a root process inside the container will be mapped to a non-root process outside the container. Sharing the user namespaces of the host with the container does not therefore isolate users on the host from users in the containers.
Remediation
You should not share user namespaces between host and containers. For example, you should not run the command below:
docker run --rm -it --userns=host ubuntu bash
Default Value
By default, the host user namespace is shared with containers unless user namespace support is enabled.
Usage
Run the control in your terminal:
powerpipe control run docker_compliance.control.cis_v160_5_31Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run docker_compliance.control.cis_v160_5_31 --shareSQL
This control uses a named query:
select id as resource, case when inspect -> 'HostConfig' ->> 'UsernsMode' = 'host' then 'alarm' else 'ok' end as status, case when inspect -> 'HostConfig' ->> 'UsernsMode' = 'host' then (names ->> 0) || ' host user namespace shared.' else (names ->> 0) || ' host user namespace not shared.' end as reason , _ctx ->> 'connection_name' as connection_namefrom docker_container;