documentation_complete: true


title: 'Verify User Who Owns The Etcd Member Pod Specification File'

description: '{{{ describe_file_owner(file="/etc/kubernetes/manifests/etcd-pod.yaml", owner="root") }}}'

rationale: |-
    The etcd pod specification file controls various parameters that
    set the behavior of the etcd service in the master node. etcd is a
    highly-available key-value store which Kubernetes uses for persistent
    storage of all of its REST API object. You should restrict its file
    permissions to maintain the integrity of the file. The file should be
    writable by only the administrators on the system.

severity: medium

identifiers:
    cce@ocp4: CCE-83988-6

references:
    cis@ocp4: 1.1.8
    nerc-cip: CIP-003-8 R6,CIP-004-6 R3,CIP-007-3 R6.1
    nist: CM-6,CM-6(1)
    srg: SRG-APP-000516-CTR-001325

ocil_clause: '{{{ ocil_clause_file_owner(file="/etc/kubernetes/manifests/etcd-pod.yaml", owner="root") }}}'

ocil: |-
    {{{ ocil_file_owner(file="/etc/kubernetes/manifests/etcd-pod.yaml", owner="root") }}}

platform: ocp4-master-node

warnings:
    - dependency: |-
        This rule is only applicable for nodes that run the Etcd service.
        The aforementioned service is only running on the nodes labeled
        "master" by default.

template:
    name: file_owner
    vars:
        filepath: ^/etc/kubernetes/manifests/etcd-pod.yaml$
        uid_or_name: '0'
        filepath_is_regex: "true"
