Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SYS.1.6.A23 #23

Open
sluetze opened this issue Nov 7, 2023 · 3 comments
Open

SYS.1.6.A23 #23

sluetze opened this issue Nov 7, 2023 · 3 comments
Assignees
Labels
not-checkable Requirement can not be checked with Compliance Operator

Comments

@sluetze
Copy link

sluetze commented Nov 7, 2023

No description provided.

@sluetze
Copy link
Author

sluetze commented Jul 17, 2024

Containers SHOULD not be able to change their file system at runtime.

This requirement must be implemented organizationally.

Note: By default, Red Hat recommends building containers so that the runtime UID does not have write permissions in the container. If the file system is changed (e.g. for a file system-based cache), this change will be lost when you restart, as the unchangeable image will be loaded again.

File systems SHOULD not be mounted with write permissions.

By default, local file systems are not mounted in containers. Containers access PVs that are integrated via OpenShift. This fulfills the requirement. Alternatively, ephemeral volumes can be used as volatile storage.

The container's root file system can be restricted to ReadOnly via the SecurityContext. Verification of this configuration can be carried out using ACS.

@benruland benruland self-assigned this Sep 6, 2024
@benruland
Copy link

I would assess this control as manual.

For section 1, I totally agree with the pasted block and will use it 1:1.

For section 2, I would also suggest organizational implemention. However, I would lay the focus more on the ReadOnly via Security context AND the readOnly option on volumeMounts.

@benruland
Copy link

PR: ComplianceAsCode#12470

@benruland benruland added the not-checkable Requirement can not be checked with Compliance Operator label Oct 4, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
not-checkable Requirement can not be checked with Compliance Operator
Projects
Status: Upstream PR
Development

No branches or pull requests

2 participants