turbot/docker_compliance
GitHub
Loading controls...

Control: 3.7 Ensure that registry certificate file ownership is set to root:root

Description

You should verify that all the registry certificate files (usually found under /etc/docker/certs.d/<registry-name> directory) are individually owned and group owned by root.

The /etc/docker/certs.d/<registry-name> directory contains Docker registry certificates. These certificate files must be individually owned and group owned by root to ensure that less privileged users are unable to modify the contents of the directory.

Remediation

The following command could be executed:

chown root:root /etc/docker/certs.d/<registry-name>/*

This would set the individual ownership and group ownership for the registry certificate files to root.

Default Value

By default, the individual ownership and group ownership for registry certificate files is correctly set to root.

Usage

Run the control in your terminal:

steampipe check docker_compliance.control.cis_v160_3_7

Snapshot and share results via Steampipe Cloud:

steampipe login
steampipe check --share docker_compliance.control.cis_v160_3_7

SQL

This control uses a named query:

exec_ownership_root_root_registry_certificate

Tags