Title

The container platform runtime must prohibit the instantiation of container images without explicit privileged status. (Cat I impact)

Discussion

Controlling access to those users and roles responsible for container image instantiation reduces the risk of untested or potentially malicious containers from being executed within the platform and on the hosting system. This access may be separate from the access required to install container images into the registry and those access requirements required to perform patch management and upgrades within the container platform. Explicit privileges (escalated or administrative privileges) provide the regular user with explicit capabilities and control that exceeds the rights of a regular user.

Check Content

Review the container platform runtime configuration to determine if only accounts given specific container instantiation privileges can execute the container image instantiation process. Attempt to instantiate a container image using an account that does not have the proper privileges to execute the process. If container images can be instantiated using an account without the proper privileges, this is a finding.

Fix Text

Configure the container platform runtime to prohibit the instantiation of container images without explicit container image instantiation privileges given to users.

Additional Identifiers

Rule ID: SV-233185r879751_rule

Vulnerability ID: V-233185

Group Title: SRG-APP-000378

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.