5.20 Do not share the host's UTS namespace

Information

UTS namespaces provide isolation of two system identifiers: the hostname and the NIS domain name. It is used forsetting the hostname and the domain that is visible to running processes in that namespace. Processes running within containers do not typically require to know hostname and domain name.Hence, the namespace should not be shared with the host.

Rationale:

Sharing the UTS namespace with the host provides full permission to the container to change thehostnameof the host. This is insecure and should not be allowed.

Solution

Do not start a container with '--uts=host' argument.

For example, do not start a container as below:

docker run --rm --interactive --tty --uts=host rhel7.2

Impact:

None.

Default Value:

By default, all containers have the UTS namespace enabled and host UTS namespace is not shared with any container.

See Also

https://workbench.cisecurity.org/files/1476

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-39

Plugin: Unix

Control ID: 782758cb58313e32950d61fc8d38b28fe4c858de1c56a16155c92051bc2ff74a