cis-docker-v170-5-3

name	cis-docker-v170-5.3
description	Ensure that, if applicable, SELinux security options are set
category	cis-docker
version	1.7.0
author	cyberstrike-official
tags	["cis","docker","runtime","configuration","selinux"]
cis_id	5.3
cis_benchmark	CIS Docker Benchmark v1.7.0
tech_stack	["docker"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS Docker Benchmark v1.7.0 - Control 5.3

Profile Applicability

• Level 2 - Docker - Linux

Description

SELinux is an effective and easy-to-use Linux application security system. It is available by default on some distributions such as Red Hat and Fedora.

Rationale

SELinux provides a Mandatory Access Control (MAC) system that greatly augments the default Discretionary Access Control (DAC) model. You can therefore add an extra layer of safety to your containers by enabling SELinux on your Linux host.

Impact

Any restrictions defined in the SELinux policy will be applied to your containers. It should be noted that if your SELinux policy is misconfigured, this may have an impact on the correct operation of the affected containers.

Audit Procedure

You should run the following command

docker ps --quiet --all | xargs docker inspect --format='{{ .Id }}: SecurityOpt={{ .HostConfig.SecurityOpt }} MountLabel={{ .MountLabel }} ProcessLabel={{ .ProcessLabel }}'

This command returns all the security options currently configured on the containers listed. Note that even if an empty SecurityOpt is returned, the MountLabel and ProcessLabel values will indicate if SELinux is in use.

Remediation

If SELinux is applicable for your Linux OS, you should use it.

1. Set the SELinux State.
2. Set the SELinux Policy.
3. Create or import a SELinux policy template for Docker containers.
4. Start Docker in daemon mode with SELinux enabled. For example:

dockerd --selinux-enabled

or by adding the following to the daemon.json configuration file:

{
  "selinux-enabled": true
}

5. Start your Docker container using the security options. For example,

docker run --interactive --tty --security-opt label=level:TopSecret centos /bin/bash

Default Value

By default, no SELinux security options are applied on containers.

References

1. https://docs.docker.com/engine/security/#other-kernel-security-features