Skip to content

4118-k8s-etcd-ownership-k8s-etcd file ownership not set to root:root¶

Rule ID¶

4118-k8s-etcd-ownership

Category¶

container

Severity¶

warn

Compatible Versions¶

Linux

Description¶

If using k8s-etcd on a system managed by systemd, verify that the k8s-etcd file ownership and group ownership are correctly set to root.

Scan Frequency¶

0 */30 * * *

Rationale¶

The k8s-etcd file contains sensitive parameters that could change the behavior of the k8s-etcd daemon. Therefore, it should be owned by root and the group should be owned by root to maintain the integrity of the file.

Risks¶

Container Security

Audit Method¶

Execute the following command to verify that the file and group are owned by root:

stat -c %U:%G /etc/kubernetes/manifests/etcd.yaml

The above command should return no output.

Remediation¶

Execute the following command:
```
#> chown root:root /etc/kubernetes/manifests/etcd.yaml
```
This will set the file ownership and group ownership to root.

Impact¶

None

Default Value¶

This file may not exist on the system. In that case, this recommendation is not applicable. By default, if the file exists, its ownership and group ownership are correctly set to root:root.

References¶

CIS Controls¶

None