documentation_complete: true


title: 'Verify Group Who Owns The Etcd PKI Certificate Files'

description: |-
  {{{ describe_file_group_owner(file="/etc/kubernetes/static-pod-resources/*/*/*/*.crt", group="root") }}}

rationale: |-
  OpenShift makes use of a number of certificates as part of its operation.
  You should verify the ownership of the directory containing the PKI
  information and all files in that directory to maintain their integrity.
  The directory and files should be owned by the system administrator.

identifiers:
  cce@ocp4: CCE-83890-4


severity: medium

references:
  cis@ocp4: 1.1.19
  nerc-cip: CIP-003-8 R6,CIP-004-6 R3,CIP-007-3 R6.1
  nist: CM-6,CM-6(1)
  srg: SRG-APP-000516-CTR-001325

ocil_clause: '{{{ ocil_clause_file_group_owner(file="/etc/kubernetes/static-pod-resources/*/*/*/*.crt", group="root") }}}'

ocil: |-
  {{{ ocil_file_group_owner(file="/etc/kubernetes/static-pod-resources/*/*/*/*.crt", group="root") }}}

platform: ocp4-master-node

warnings:
  - dependency: |-
      This rule is only applicable for nodes that run the Etcd service.
      The aforementioned service is only running on the nodes labeled
      "master" by default.

# Note that this recursively checks for files, and the form is as follows:
#
#  /etc/kubernetes/static-pod-resources/.*/.*/.*/tls\.key
#
# Taking as an example:
#
#  /etc/kubernetes/static-pod-resources/etcd-pod-2/secrets/etcd-all-serving/etcd-serving-ip-10-0-136-27.ec2.internal.crt
#
# - /etc/kubernetes/static-pod-resources/ is the base path
# - 'etcd-pod-2' This initial versioned resourced directory (e.g. pod version)
# - 'secrets' The type of resource (e.g. configmap or secret)
# - 'etcd-all-serving' the mount name
# - 'etcd-serving-ip-10-0-136-27.ec2.internal.crt' the cert file
template:
  name: file_groupowner
  vars:
    filepath: ^/etc/kubernetes/static-pod-resources/.*/.*/.*/.*\.crt$
    gid_or_name: '0'
    filepath_is_regex: "true"
