documentation_complete: true


platform: ocp4-node

title: 'Verify Group Who Owns The Open vSwitch Daemon PID File'

description: |-
    Ensure that the file <pre>/run/openvswitch/ovs-vswitchd.pid</pre>,
    is owned by the group <pre>openvswitch</pre> or <pre>hugetlbfs</pre>,
    depending on your settings and Open vSwitch version.

rationale: |-
    CNI (Container Network Interface) files consist of a specification and libraries for
    writing plugins to configure network interfaces in Linux containers, along with a number
    of supported plugins. Allowing writeable access to the files could allow an attacker to modify
    the networking configuration potentially adding a rogue network connection.

severity: medium

identifiers:
    cce@ocp4: CCE-84129-6

references:
    cis@ocp4: 1.1.9
    nerc-cip: CIP-003-8 R6,CIP-004-6 R3,CIP-007-3 R6.1
    nist: CM-6,CM-6(1)
    srg: SRG-APP-000516-CTR-001325

ocil_clause: '/run/openvswitch/ovs-vswitchd.pid has group owner openvswitch or hugetlbfs'

ocil: |-
    To check the group ownership of <pre>/run/openvswitch/ovs-vswitchd.pid</pre>,
    you'll need to log into a node in the cluster.
    As a user with administrator privileges, log into a node in the relevant pool:

    <pre>
    $ oc debug node/$NODE_NAME
    </pre>

    At the <tt>sh-4.4#</tt> prompt, run:

    <pre>
    # chroot /host
    </pre>

    Then,run the command:
    <pre>
    $ ls -l /run/openvswitch/ovs-vswitchd.pid
    </pre>
    If properly configured, the output should indicate one of the following group-owners:
    openvswitch or hugetlbfs
