Cis Ocp Vm V100 1 8

CIS 1.8 — Ensure kubevirt seccomp profile file permission is set to 700 or more restrictive

Profile Applicability

• Level 1

Description

Setting the kubevirt Secure Computing Mode (seccomp) file permissions to 700 or more restrictive limits access to security related administrative functionality to approved administrators.

Rationale

This configuration ensures that only authorized users have access to modify the seccomp profile, thereby preventing unauthorized alterations to the allowed system calls for virt-launcher pods. By enforcing stringent permission controls, potential security risks associated with unrestricted access to sensitive system calls can be mitigated.

Impact

None.

Audit Procedure

Verify seccomp file permissions for the virt-launcher pod, run the following command:

$ for pod in $(oc get pod -n openshift-cnv -l kubevirt.io=virt-handler --no-headers -o custom-columns=":metadata.name");do
  oc exec -ti -n openshift-cnv $pod -c virt-handler -- stat -c %a /proc/1/root/var/lib/kubelet/seccomp/kubevirt/kubevirt.json
done

Should return 700 or if the file doesn't exist then the corresponding feature gate is not enabled and this check can be safely ignored.

Remediation

Update the permissions on each node using chmod:

$ oc exec <virt-handler-pod> -ti -n openshift-cnv -- chmod 700 /proc/1/root/var/lib/kubelet/seccomp/kubevirt/kubevirt.json

Default Value

If the Secure Computing Mode feature is enabled, the permissions of this file are 700 by default.

References

• CIS Redhat OpenShift Virtual Machine Extension Benchmark v1.0.0, Section 1.8

CIS Controls

MITRE ATT&CK Mappings

Profile

• Level 1 - OpenShift Virtualization