Skip to content

Verify Permissions on the OVNKubernetes DB files

An XCCDF Rule

Description

To properly set the permissions of /var/lib/ovn/etc/*.db, run the command:

$ sudo chmod 0640 /var/lib/ovn/etc/*.db

Rationale

CNI (Container Network Interface) files consist of a specification and libraries for writing plugins to configure network interfaces in Linux containers, along with a number of supported plugins. Allowing writeable access to the files could allow an attacker to modify the networking configuration potentially adding a rogue network connection.

ID
xccdf_org.ssgproject.content_rule_file_permissions_ovn_db_files
Severity
Medium
References
Updated