Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
All Docker Enterprise containers must be restricted from acquiring additional privileges.
Description
Discussion Text
Restrict the container from acquiring additional privileges via suid or sgid bits.
A process can set the no_new_priv bit in the kernel. It persists across fork, clone, and execve. The no_new_priv bit ensures that the process or its children processes do not gain any additional privileges via suid or sgid bits. This way a lot of dangerous operations become a lot less dangerous because there is no possibility of subverting privileged binaries.
no_new_priv prevents LSMs like SELinux from transitioning to process labels that have access not allowed to the current process.
By default, new privileges are not restricted.
A process can set the no_new_priv bit in the kernel. It persists across fork, clone, and execve. The no_new_priv bit ensures that the process or its children processes do not gain any additional privileges via suid or sgid bits. This way a lot of dangerous operations become a lot less dangerous because there is no possibility of subverting privileged binaries.
no_new_priv prevents LSMs like SELinux from transitioning to process labels that have access not allowed to the current process.
By default, new privileges are not restricted.
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.