OpenShift must protect log directory from any type of unauthorized access by setting file permissions.
Severity | Group ID | Group Title | Version | Rule ID | Date | STIG Version |
|---|---|---|---|---|---|---|
| medium | V-257530 | SRG-APP-000118-CTR-000240 | CNTR-OS-000280 | SV-257530r960930_rule | 2024-12-06 | 2 |
| Description |
|---|
| Log files contain sensitive information such as user credentials, system configurations, and potentially even security-related events. Unauthorized access to log files can expose this sensitive data to malicious actors. By protecting the log directory, OpenShift ensures that only authorized users or processes can access the log files, preserving the confidentiality of the information contained within them. |
| ℹ️ Check |
|---|
| Verify the "/var/log" directory has a mode of "0755" or less by executing the following: for node in $(oc get node -oname); do oc debug $node -- chroot /host /bin/bash -c 'echo -n "$HOSTNAME "; stat -c "%a %n" /var/log' 2>/dev/null; done If a value of "0755" or less permissive is not returned, this is a finding. |
| ✔️ Fix |
|---|
| Correct log directory permissions by executing the following: for node in $(oc get node -oname); do oc debug $node -- chroot /host /bin/bash -c 'echo -n "$HOSTNAME "; chmod 755 /var/log/' 2>/dev/null; done |