Details
Sensitive host system directories such as below should not be allowed to be mounted as container volumes especially in read-write mode.
Linux:
/
/boot
/dev
/etc
/lib
/proc
/sys
/usr
Windows:
%windir% (C:Windows)
%windir%system32 (C:Windowssystem32)
%programdata%
%programData%docker
C:Program Files
C:Program Files (x86)
C:Users
If sensitive directories are mounted in read-write mode, it would be possible to make changes to files within those sensitive directories. The changes might bring down security implications or unwarranted changes that could put the Docker host in compromised state.
Docker defaults to a read-write volume but the user can also mount a directory read-only. By default, no sensitive host directories are mounted on containers.
Solution
This fix only applies to the use of Docker Engine - Enterprise.
Do not mount host sensitive directories on containers especially in read-write mode.
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: Access Control.This control applies to the following type of system Unix.
References
- 800-53|AC-3
- CAT|II
- CCI|CCI-000213
- Rule-ID|SV-235783r627476_rule
- STIG-ID|DKER-EE-001190
- STIG-Legacy|SV-104737
- STIG-Legacy|V-95599
- Vuln-ID|V-235783
Comments
Please sign in to leave a comment.