4121-k8s-edct-dir-priv-etcd Data Directory Permissions Not Set to 700 or More Restrictive¶

Rule ID¶

• 4121-k8s-edct-dir-priv

Category¶

• container

Severity¶

• info

Compatible Versions¶

• Linux

Description¶

• Ensure that the etcd data directory has permissions of 700 or more restrictive.

Scan Frequency¶

• 0 */30 * * *

Rationale¶

• etcd is a highly available key-value store used by Kubernetes deployments to persist all REST API objects. This data directory should be protected from any unauthorized read or write access.

Risk¶

• Container Security

Audit Method¶

• Run the following command to verify that the file permissions are set to 644 or more restrictive:

stat -c %a /var/lib/etcd

Remediation¶

• Execute the following command to modify the permissions of the three configuration files:

  #> chmod 700 /var/lib/etcd
  

  This sets the directory permissions to 700.

Impact¶

• None

Default Value¶

• By default, the permissions of /var/lib/etcd are 755.

References¶

• Kubernetes etcd
• etcd

CIS Controls¶

• None