Verify Permissions on the OVNKubernetes socket
An XCCDF Rule
Description
To properly set the permissions of /run/ovn-kubernetes/cni/ovn-cni-server.sock, run the command:
$ sudo chmod 0600 /run/ovn-kubernetes/cni/ovn-cni-server.sock
Rationale
CNI (Container Network Interface) files consist of a specification and libraries for writing plugins to configure network interfaces in Linux containers, along with a number of supported plugins. Allowing writeable access to the files could allow an attacker to modify the networking configuration potentially adding a rogue network connection.
- ID
- xccdf_org.ssgproject.content_rule_file_permissions_ovn_cni_server_sock
- Severity
- Medium
- References
- Updated