SV-242407r960960: The Kubernetes KubeletConfiguration files must have file permissions set to 644 or more restrictive. | Kubernetes STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

The Kubernetes KubeletConfiguration files must have file permissions set to 644 or more restrictive.

Description

Discussion Text

The kubelet configuration file contains the runtime configuration of the kubelet service. If an attacker can gain access to this file, changes can be made to open vulnerabilities and bypass user authorizations inherit within Kubernetes with RBAC implemented.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-001499

References

DPMS Target Kubernetes DISA DPMS Target Kubernetes 5376

Checks

DISA STIG (Manual Reference)

 On the Kubernetes Control Plane and Worker nodes, run the command:
ps -ef | grep kubelet

Check the config file (path identified by: --config):

Change to the directory identified by --config (example /etc/sysconfig/) and run the command:
ls -l kubelet

Each KubeletConfiguration file must have permissions of "644" or more restrictive.

If any KubeletConfiguration file is less restrictive than "644", this is a finding.

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.stig.kubernetes:def:242407
# The Kubernetes KubeletConfiguration files must have file permissions set to 644 or more restrictive.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.
#
# MANUAL REVIEW REQUIRED -- the module(s) below could not be reconstructed
# into working code from curated SCC reference data, and are excluded from
# the automated result:
#   - file_object (file_test): no extractor for field "gexec"

echo "MANUAL REVIEW REQUIRED -- see notes above; no part of this check could be automated"

Remediation

On the Kubernetes Control Plane and Worker nodes, run the command:
ps -ef | grep kubelet

Check the config file (path identified by: --config):

Change to the directory identified by --config (example /etc/sysconfig/) and run the command:
chmod 644 kubelet

To verify the change took place, run the command:
ls -l kubelet

The kubelet file should now have the permissions of "644".