The Kubernetes etcd must have file permissions set to 644 or more restrictive.
An XCCDF Rule
Description
<VulnDiscussion>The Kubernetes etcd key-value store provides a way to store data to the Control Plane. If these files can be changed, data to API object and Control Plane would be compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-242459r961863_rule
- Severity
- Medium
- References
- Updated
Remediation - Manual Procedure
Change the permissions of the manifest files to "644" by executing the command:
chmod -R 644 /var/lib/etcd/*