documentation_complete: true


title: 'Verify Group Who Owns The Etcd Database Directory'

description: |-
    {{{ describe_file_group_owner(file="/var/lib/etcd/member/", group="root") }}}

rationale: |-
    etcd is a highly-available key-value store used by Kubernetes deployments for
    persistent storage of all of its REST API objects. This data directory should
    be protected from any unauthorized reads or writes.

severity: medium

identifiers:
    cce@ocp4: CCE-83354-1

references:
    cis@ocp4: 1.1.12
    nerc-cip: CIP-003-8 R6,CIP-004-6 R3,CIP-007-3 R6.1
    nist: CM-6,CM-6(1)
    srg: SRG-APP-000516-CTR-001325

ocil_clause: '{{{ ocil_clause_file_group_owner(file="/var/lib/etcd/member/", group="root") }}}'

ocil: |-
    {{{ ocil_file_group_owner(file="/var/lib/etcd/member/", group="root") }}}

platform: ocp4-master-node

warnings:
    - dependency: |-
        This rule is only applicable for nodes that run the Etcd service.
        The aforementioned service is only running on the nodes labeled
        "master" by default.

template:
    name: file_groupowner
    vars:
        filepath: /var/lib/etcd/member/
        gid_or_name: '0'
