메뉴
Ensure that the Container Network Interface file ownership is set to root:root (Manual)
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-ocp-v170-1-1-10명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
SOC 직업 분류 기준
SKILL.md 표시 중
| name | cis-ocp-v170-1.1.10 |
| description | Ensure that the Container Network Interface file ownership is set to root:root (Manual) |
| category | cis-openshift |
| version | 1.7.0 |
| author | cyberstrike-official |
| tags | ["cis","openshift","kubernetes","redhat","control-plane","master-node","config-files"] |
| cis_id | 1.1.10 |
| cis_benchmark | CIS Red Hat OpenShift Container Platform Benchmark v1.7.0 |
| tech_stack |
| ["kubernetes","openshift","redhat"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Ensure that the Container Network Interface files have ownership set to root:root.
Container Network Interface provides various networking options for overlay networking. You should consult their documentation and restrict their respective file permissions to maintain the integrity of those files. Those files should be owned by root:root.
None.
The Cluster Network Operator (CNO) deploys and manages the cluster network components on an OpenShift Container Platform cluster. This includes the Container Network Interface (CNI) default network provider plug-in selected for the cluster during installation. OpenShift Container Platform uses the Multus CNI plug-in to allow chaining of CNI plug-ins. The default Pod network must be configured during cluster installation. By default, the CNO deploys the OpenShift SDN as the default Pod network.
Ensure that the multu and openshift-sdn file ownership is set to root:root and the Open vSwitch (OVS) file ownership is set to openvswitch:openvswitch.
The SDN components are deployed as DaemonSets across the master/worker nodes with controllers limited to control plane nodes. OpenShift deploys OVS as a network overlay by default. Various configurations (ConfigMaps and other files managed by the operator via hostpath but stored on the container hosts) are stored in the following locations:
CNI:
/etc/cni/net.d/host/var/run/multus/cni/net.dSDN:
/var/lib/cni/networks/openshift-sdn/var/run/openshift-sdnSDN OVS:
/var/run/openvswitch/etc/openvswitch/run/openvswitchRun the following commands to verify ownership when using CNI multus:
for i in $(oc get pods -n openshift-multus -l app=multus -oname); do oc exec -n openshift-multus $i -- /bin/bash -c "stat -c \"%U:%G %n\" /host/etc/cni/net.d/*.conf"; done
for i in $(oc get pods -n openshift-multus -l app=multus -oname); do oc exec -n openshift-multus $i -- /bin/bash -c "stat -c \"%U:%G %n\" /host/var/run/multus/cni/net.d/*.conf"; done
Run the following commands to verify the ownership when using OpenShift SDN:
for i in $(oc get pods -n openshift-sdn -l app=sdn -oname); do oc exec -n openshift-sdn $i -- find /var/lib/cni/networks/openshift-sdn -type f -exec stat -c \"%U:%G\" {} \;; done
for i in $(oc get pods -n openshift-sdn -l app=sdn -oname); do oc exec -n openshift-sdn $i -- find /var/run/openshift-sdn -type f -exec stat -c %U:%G {} \;; done
Run the following commands to verify the permissions when using OVS:
for i in $(oc get pods -n openshift-sdn -l app=ovs -oname); do oc exec -n openshift-sdn $i -- find /var/run/openvswitch -type f -exec stat -c %U:%G {} \;; done
for i in $(oc get pods -n openshift-sdn -l app=ovs -oname); do oc exec -n openshift-sdn $i -- find /etc/openvswitch -type f -exec stat -c %U:%G {} \;; done
for i in $(oc get pods -n openshift-sdn -l app=ovs -oname); do oc exec -n openshift-sdn $i -- find /run/openvswitch -type f -exec stat -c %U:%G {} \;; done
Verify file ownership is set to root:root.
In deployments using OCS, verify that the file ownership is set to openvswitch:openvswitch.
/var/run/openvswitch = openvswitch:openvswitch/etc/openvswitch = openvswitch:openvswitch/run/openvswitch = openvswitch:openvswitchNo remediation required; file permissions are managed by the operator.
In OpenShift 4, the default file ownership is root:root for CNI Multus and SDN and openvswitch:openvswitch for the OVS plugin.
/host/etc/cni/net.d/00-multus.conf = root:root/host/var/run/multus/cni/net.d/80-openshift-network.conf = root:root/var/lib/cni/networks/openshift-sdn = root:root/var/run/openshift-sdn = root:root/var/run/openvswitch = openvswitch:openvswitch/etc/openvswitch = openvswitch:openvswitch/run/openvswitch = openvswitch:openvswitch| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts | * | * | * |
| v7 | 4.3 Ensure the Use of Dedicated Administrative Accounts | * | * | * |
| Techniques / Sub-techniques | Tactics | Mitigations |
|---|---|---|
| T1083, T1222 | TA0005, TA0007 | M1026 |
Level 1 (Manual)