Verify Permissions on the Kubernetes Scheduler Pod Specification File
An XCCDF Rule
Description
To properly set the permissions of /etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/kube-scheduler-pod.yaml, run the command:
$ sudo chmod 0644 /etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/kube-scheduler-pod.yaml
warning alert: Dependency Warning
This rule is only applicable for nodes that run the Kubernetes Scheduler service.
The aforementioned service is only running on the nodes labeled
"master" by default.
Rationale
If the Kubernetes specification file is writable by a group-owner or the world the risk of its compromise is increased. The file contains the configuration of an Kubernetes Scheduler service that is configured on the system. Protection of this file is critical for OpenShift security.
- ID
- xccdf_org.ssgproject.content_rule_file_permissions_scheduler
- Severity
- Medium
- References
- Updated