القائمة
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-docker-5-31يبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
استنادا إلى تصنيف SOC المهني
عرض SKILL.md
| name | cis-docker-5.31 |
| description | Ensure that the host's user namespaces are not shared |
| category | cis-docker |
| version | 1.8.0 |
| author | cyberstrike-official |
| tags | ["cis","docker","linux","containers","runtime","namespaces"] |
| cis_id | 5.31 |
| cis_benchmark | CIS Docker Benchmark v1.8.0 |
| tech_stack | ["linux","docker"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
You should not share the host's user namespaces with containers running on it.
User namespaces ensure that a root process inside the container will be mapped to a non-root process outside the container. Sharing the user namespaces of the host with the container does not therefore isolate users on the host from users in the containers.
None
You should run the command below and ensure that it does not return any value for UsernsMode. If it returns a value of host, it means that the host user namespace is shared with its containers.
docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: UsernsMode={{ .HostConfig.UsernsMode }}'
You should not share user namespaces between host and containers. For example, you should not run the command below:
docker run --rm -it --userns=host ubuntu bash
By default, the host user namespace is shared with containers unless user namespace support is enabled.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 3.12 Segment Data Processing and Storage Based on Sensitivity Segment data processing and storage based on the sensitivity of the data. Do not process sensitive data on enterprise assets intended for lower sensitivity data. | ● | ● | |
| v7 | 12 Boundary Defense Boundary Defense | |||
| v7 | 14.1 Segment the Network Based on Sensitivity Segment the network based on the label or classification level of the information stored on the servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs). | ● | ● |