Prisma Cloud Compute Console must run as nonroot user (uid 2674).
An XCCDF Rule
Description
<VulnDiscussion>Containers not requiring root-level permissions must run as a unique user account. To ensure accountability and prevent unauthenticated access to containers, the user the container is using to execute must be uniquely identified and authenticated to prevent potential misuse and compromise of the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-253536r960969_rule
- Severity
- Medium
- References
- Updated
Remediation - Manual Procedure
In the root directory of the extracted release tar file, modify the twistlock.cfg file's line:
RUN_CONSOLE_AS_ROOT=false
For Kubernetes deployment, perform these additional steps:
When generating the twistlock_console.yaml deployment file, supply the --run-as-user flag.