DKER-EE-002120 - The Docker Enterprise hosts user namespace must not be shared.

Information

Do not share the host's user namespaces with the containers.

User namespaces ensure that a root process inside the container will be mapped to a non-root process outside the container. Sharing the user namespaces of the host with the container thus does not isolate users on the host with users on the containers.

By default, the host user namespace is shared with the containers until user namespace support is enabled.

Solution

This fix only applies to the use of Docker Engine - Enterprise on a Linux host operating system.

Do not share user namespaces between host and containers.

For example, do not run a container as below:

docker run --rm -it --userns=host <image>

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Docker_Enterprise_2-x_Linux-Unix_V2R2_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7a., CAT|I, CCI|CCI-000381, Rule-ID|SV-235817r960963_rule, STIG-ID|DKER-EE-002120, STIG-Legacy|SV-104807, STIG-Legacy|V-95669, Vuln-ID|V-235817

Plugin: Unix

Control ID: 2a4bdbc47d14d0ed6a329e1621c0d9e2e8b52339c06821c037df635973cb535f