Title

The container platform registry must employ a deny-all, permit-by-exception (whitelist) policy to allow only authorized container images in the container platform. (Cat II impact)

Discussion

Controlling the sources where container images can be pulled from allows the organization to define what software can be run within the container platform. Allowing any container image to be introduced and instantiated within the container platform may introduce malicious code and vulnerabilities to the platform and the hosting system. The container platform registry must deny all container images except for those signed by organizational-approved sources.

Check Content

Review documentation and configuration settings to identify if the container platform whitelisting specifies which container platform components are allowed to execute. Check for the existence of policy settings or policy files that can be configured to restrict container platform component execution. Demonstrate how the program execution is restricted. Look for a deny-all, permit-by-exception policy of restriction. Some methods for restricting execution include but are not limited to the use of custom capabilities built into the application or Software Restriction Policies, Application Security Manager, or Role-Based Access Controls (RBAC). If container platform whitelisting is not utilized or does not follow a deny-all, permit-by-exception (whitelist) policy, this is a finding.

Fix Text

Configure the container platform to utilize a deny-all, permit-by-exception policy when allowing the execution of authorized software.

Additional Identifiers

Rule ID: SV-233192r879759_rule

Vulnerability ID: V-233192

Group Title: SRG-APP-000386

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.