SV-242434r961131: Kubernetes Kubelet must enable kernel protection. | Kubernetes STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

Kubernetes Kubelet must enable kernel protection.

Description

Discussion Text

System kernel is responsible for memory, disk, and task management. The kernel provides a gateway between the system hardware and software. Kubernetes requires kernel access to allocate resources to the Control Plane. Threat actors that penetrate the system kernel can inject malicious code or hijack the Kubernetes architecture. It is vital to implement protections through Kubernetes components to reduce the attack surface.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-001084

References

DPMS Target Kubernetes DISA DPMS Target Kubernetes 5376

Checks

DISA STIG (Manual Reference)

On the Control Plane, run the command:
ps -ef | grep kubelet

If the "--protect-kernel-defaults" option exists, this is a finding.

Note the path to the config file (identified by --config).

Run the command:
grep -i protectKernelDefaults <path_to_config_file>

If the setting "protectKernelDefaults" is not set or is set to false, this is a finding.

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.stig.kubernetes:def:242434
# Kubernetes Kubelet must enable kernel protection.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.
#
# MANUAL REVIEW REQUIRED -- the module(s) below could not be reconstructed
# into working code from curated SCC reference data, and are excluded from
# the automated result:
#   - textfilecontent54_object (textfilecontent54_test): no extractor for field "subexpression"

# process58_object (process58_test)
test_2() {
  ! ( ps -eo args | grep -P '/usr/bin/kubelet\b.*--protect-kernel-defaults\b' &>/dev/null )
}

if test_2; then
  echo "PASS (automated portion only -- MANUAL REVIEW still required, see notes above)"
else
  echo "FAIL (or see MANUAL REVIEW note above)"
fi

Remediation

On the Control Plane, run the command:
ps -ef | grep kubelet

Remove the "--protect-kernel-defaults" option if present.

Note the path to the Kubernetes Kubelet config file (identified by --config).

Edit the Kubernetes Kubelet config file: 
Set "protectKernelDefaults" to "true". 

Restart the kubelet service using the following command:
systemctl daemon-reload && systemctl restart kubelet