cis-docker-v170-5-4

name	cis-docker-v170-5.4
description	Ensure that Linux kernel capabilities are restricted within containers
category	cis-docker
version	1.7.0
author	cyberstrike-official
tags	["cis","docker","runtime","configuration","capabilities"]
cis_id	5.4
cis_benchmark	CIS Docker Benchmark v1.7.0
tech_stack	["docker"]
cwe_ids	["CWE-250"]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS Docker Benchmark v1.7.0 - Control 5.4

Profile Applicability

• Level 1 - Docker - Linux

Description

By default, Docker starts containers with a restricted set of Linux kernel capabilities. This means that any process can be granted the required capabilities instead of giving it root access. Using Linux kernel capabilities, processes in general do not need to run as the root user.

Rationale

Docker supports the addition and removal of capabilities. You should remove all capabilities not required for the correct function of the container.

Specifically, in the default capability set provided by Docker, the NET_RAW capability should be removed if not explicitly required, as it can give an attacker with access to a container the ability to create spoofed network traffic.

Impact

Restrictions on processes within a container are based on which Linux capabilities are in force.

Audit Procedure

You should run the following command:

docker ps --quiet --all | xargs docker inspect --format='{{ .Id }}: CapAdd={{ .HostConfig.CapAdd }} CapDrop={{ .HostConfig.CapDrop }}'

Verify that the added and deleted Linux kernel capabilities are in line with the ones needed by the container process in each container instance. Specifically, ensure that the NET_RAW capability is removed if not required.

Remediation

You should execute the command below to add required capabilities:

docker run --cap-add={"Capability 1","Capability 2"} <Run arguments> <Container Image Name or ID> <Command>

You should execute the command below to remove unneeded capabilities:

docker run --cap-drop={"Capability 1","Capability 2"} <Run arguments> <Container Image Name or ID> <Command>

Alternatively, you could remove all the currently configured capabilities and then restore only the ones you specifically use:

docker run --cap-drop=all --cap-add={"Capability 1","Capability 2"} <Run arguments> <Container Image Name or ID> <Command>

Note that some settings can also be configured using the --sysctl option, reducing the need for container capabilities even further. This includes unprivileged ICMP echo sockets without NET_RAW and allowing opening any port less than 1024 without .