Docker Enterprise exec commands must not be used with the user option.
An XCCDF Rule
Description
<VulnDiscussion>Do not docker exec with --user option. Using --user option in docker exec executes the command within the container as that user. Do not run docker exec with the --user option , especially when running containers with dropped capabilities or with enhanced restrictions. For example, suppose the container is running as tomcat user (or any other non-root user), it would be possible to run a command through docker exec as rootwith --user=root option. By default, docker exec command runs without --user option.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-235814r627569_rule
- Severity
- Medium
- References
- Updated
Remediation - Manual Procedure
This fix only applies to the use of Docker Engine - Enterprise on a Linux host operating system.
Do not use --user option in docker exec command.
A reference for the docker exec command can be found at https://docs.docker.com/engine/reference/commandline/exec/.