Verify Group Who Owns The Open vSwitch Configuration Database Lock
An XCCDF Rule
Description
Check if the group owner of /etc/openvswitch/conf.db.~lock~ is
hugetlbfs on architectures other than s390x or openvswitch
on s390x.
Rationale
CNI (Container Network Interface) files consist of a specification and libraries for writing plugins to configure network interfaces in Linux containers, along with a number of supported plugins. Allowing writeable access to the files could allow an attacker to modify the networking configuration potentially adding a rogue network connection.
- ID
- xccdf_org.ssgproject.content_rule_file_groupowner_ovs_conf_db_lock
- Severity
- Medium
- References
- Updated