cis-ocp-vm-v100-3-1

name	cis-ocp-vm-v100-3-1
description	Restrict access to cross datavolumes cloning (Manual)
category	cis-openshift-virtualization
version	1.0
author	cyberstrike-official
tags	["cis","openshift","kubernetes","openshift-virtualization","kubevirt","vm","storage-components"]
cis_id	3.1
cis_benchmark	CIS Redhat OpenShift Virtual Machine Extension Benchmark v1.0.0
tech_stack	["kubernetes","openshift","openshift-virtualization","kubevirt"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS 3.1 — Restrict access to cross datavolumes cloning

Profile Applicability

• Level 1

Description

Datavolume cross-namespace cloning allows cloning a datavolume from one namespace to another, breaking the namespace isolation.

Rationale

Any user with access to multiple namespaces for the purpose of cloning a datavolume consequently has access to the underlying data of a volume they do not own.

Impact

Limiting access to namespaces means cross namespace datavolume cloning will not be possible.

Audit Procedure

To check which role bindings have the ability to clone across namespaces, use the following command where to list all the rolebinding and verify which one has a ClusterRole which enables it to operate on data volumes and have bound a service account in another namespace. Ensure that the destination namespace is a desired one.

$ oc get rolebinding -n <source-namespace> <allow-clone-to-user> -oyaml

Output will be in the following format:

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: <role-binding-name>
  namespace: <source namespace>
subjects:
- kind: ServiceAccount
  name: default
  namespace: <destination namespace>
roleRef:
  kind: ClusterRole
  name: <datavolume-cloner>
  apiGroup: rbac.authorization.k8s.io

Example:

$ oc get clusterRole datavolume-cloner -oyaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"rbac.authorization.k8s.io/v1","kind":"ClusterRole","metadata":{"annotations":{},"name":"datavolume-cloner"},"rules":[{"apiGroups":["cdi.kubevirt.io"],"resources":["datavolumes/source"],"verbs":["*"]}]}
  creationTimestamp: "2025-02-06T14:51:36Z"
  name: datavolume-cloner
  resourceVersion: "9267"
  uid: 4ad67fec-0461-4cbe-b460-a0fb5533be6d
rules:
- apiGroups:
  - cdi.kubevirt.io
  resources:
  - datavolumes/source
  verbs:
  - '*'

The clusterRole datavolume-cloner allows copying thedatavolume source. In the example, the command lists all the rolebindings in the source namespace and one of them enables the default service account in the namespace dst-ns to clone all the data volumes from the namespace src-ns.

Remediation

Remove any rolebinding resources that grant unintended access across namespaces.

Please refer to the latest OpenShift documentation for details on this process.

Default Value

Data volume cloning is limited to cluster administrators by default. Delegating the migration of data volumes across namespaces requires a cluster administrator to create new roles and role bindings for users who require that functionality for their job responsibilities.