5.2 Ensure that, if applicable, an AppArmor Profile is enabled

Information

AppArmor is an effective and easy-to-use Linux application security system. It is available on some Linux distributions by default, for example, on Debian and Ubuntu.

Rationale:

AppArmor protects the Linux OS and applications from various threats by enforcing a security policy which is also known as an AppArmor profile. You can create your own AppArmor profile for containers or use Docker's default profile. Enabling this feature enforces security policies on containers as defined in the profile.

Impact:

The container will have the security controls defined in the AppArmor profile. It should be noted that if the AppArmor profile is misconfigured, this may cause issues with the operation of the container.

Solution

If AppArmor is applicable for your Linux OS, you should enable it.

Verify AppArmor is installed.

Create or import a AppArmor profile for Docker containers.

Enable enforcement of the policy.

Start your Docker container using the customized AppArmor profile. For example:

docker run --interactive --tty --security-opt='apparmor:PROFILENAME' ubuntu /bin/bash

Alternatively, Docker's default AppArmor policy can be used.

Default Value:

By default, the docker-default AppArmor profile is applied to running containers. The Docker binary generates this profile and then loads it into the kernel.

See Also

https://workbench.cisecurity.org/files/4532

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-16, CSCv7|5.2

Plugin: Unix

Control ID: bef537c34f0bb835deb5b98f9150130d0f9ce7ba0fd5796c528741ad885fa98b