1.15 Audit Docker files and directories - /usr/bin/docker-runc

Information

Audit /usr/bin/docker-runc, if applicable.Apart from auditing your regular Linux file system and system calls, audit all Docker
related files and directories. Docker daemon runs with 'root' privileges. Its behavior
depends on some key files and directories. /usr/bin/docker-runc is one such file. Docker
now relies on containerd and runC to spawn containers. It must be audited, if applicable.

Solution

Add a rule for /usr/bin/docker-runc file.For example,Add the line as below in /etc/audit/audit.rules file--w /usr/bin/docker-runc -k dockerThen, restart the audit daemon. For example,service auditd restartImpact-Auditing generates quite big log files. Ensure to rotate and archive them periodically. Also,
create a separate partition of audit to avoid filling root file system.
Default Value-By default, Docker related files and directories are not audited. The file /usr/bin/docker-
runc may not be available on the system. In that case, this recommendation is not
applicable.

See Also

https://workbench.cisecurity.org/files/517

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-12c.

Plugin: Unix

Control ID: 57247eae772172cd922589aa7e6b209b35b5d7e8a5f047957d4c656d9ee25a45