Profiling is protected by RBAC
An XCCDF Rule
Description
Ensure that the cluster-debugger cluster role includes the /debug/pprof resource URL. This demonstrates that profiling is protected by RBAC, with a specific cluster role to allow access.
warning alert: Warning
/apis/rbac.authorization.k8s.io/v1/clusterroles/cluster-debugger API endpoint to the local Rationale
Profiling allows for the identification of specific performance bottlenecks. It generates a significant amount of program data that could potentially be exploited to uncover system and program details. If you are not experiencing any bottlenecks and do not need the profiler for troubleshooting purposes, it is recommended to turn it off to reduce the potential attack surface. To ensure the collected data is not exploited, profiling endpoints are secured via RBAC (see cluster-debugger role). By default, the profiling endpoints are accessible only by users bound to cluster-admin or cluster-debugger role. Profiling can not be disabled.
- ID
- xccdf_org.ssgproject.content_rule_rbac_debug_role_protects_pprof
- Severity
- Medium
- References
- Updated