documentation_complete: true


platform: ocp4-node-on-ovn

title: 'Verify Group Who Owns The OVNKubernetes DB files'

description: |-
  {{{ describe_file_group_owner(file="/var/lib/ovn/etc/*.db", group="root") }}}

rationale: |-
    CNI (Container Network Interface) files consist of a specification and libraries for
    writing plugins to configure network interfaces in Linux containers, along with a number
    of supported plugins. Allowing writeable access to the files could allow an attacker to modify
    the networking configuration potentially adding a rogue network connection.

identifiers:
  cce@ocp4: CCE-86533-7

severity: medium

references:
  cis@ocp4: 1.1.10
  nerc-cip: CIP-003-8 R6,CIP-004-6 R3,CIP-007-3 R6.1
  nist: CM-6,CM-6(1)
  srg: SRG-APP-000516-CTR-001325

ocil_clause: '{{{ ocil_clause_file_group_owner(file="/var/lib/ovn/etc/*.db", group="root") }}}'

ocil: |-
  {{{ ocil_file_group_owner(file="/var/lib/ovn/etc/*.db", group="root") }}}

template:
  name: file_groupowner
  vars:
    filepath: ^/var/lib/ovn/etc/*.db$
    gid_or_name: '0'
    filepath_is_regex: "true"
