SV-242406r960960: The Kubernetes KubeletConfiguration file must be owned by root. | Kubernetes STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

The Kubernetes KubeletConfiguration file must be owned by root.

Description

Discussion Text

The kubelet configuration file contains the runtime configuration of the kubelet service. If an attacker can gain access to this file, changes can be made to open vulnerabilities and bypass user authorizations inherent within Kubernetes with RBAC implemented.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-001499

References

DPMS Target Kubernetes DISA DPMS Target Kubernetes 5376

Checks

DISA STIG (Manual Reference)

On the Kubernetes Control Plane and Worker nodes, run the command:
ps -ef | grep kubelet

Check the config file (path identified by: --config):

Change to the directory identified by --config (example /etc/sysconfig/) run the command:
ls -l kubelet

Each kubelet configuration file must be owned by root:root.

If any manifest file is not owned by root:root, this is a finding.

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# OVAL Definition: oval:mil.disa.stig.kubernetes:def:242406
FILEPATH=$(cat /etc/os-release | grep "NAME" | cut -d '=' -f 2 | tr -d '[\" ]')
if [ ! -f "$FILEPATH/etc/kubernetes/pki/config.yaml" ]; then echo "PASS"; exit 0; fi
if [ -f "$FILEPATH/etc/kubernetes/pki/config.yaml" ]; then
  OWNER=$(stat -c "%U" "$FILEPATH/etc/kubernetes/pki/config.yaml")
  GRP=$(stat -c "%G" "$FILEPATH/etc/kubernetes/pki/config.yaml")
  if [ "$OWNER" = "0" ] && [ "$GRP" = "0" ]; then echo "PASS"; exit 0; else echo "FAIL"; exit 1; fi
fi

Remediation

On the Control Plane and Worker nodes, change to the --config directory. Run the command:
chown root:root kubelet

To verify the change took place, run the command:
ls -l kubelet

The kubelet file should now be owned by root:root.