documentation_complete: true


title: 'Verify Permissions on the Etcd Database Directory'

description: |-
    {{{ describe_file_permissions(file="/var/lib/etcd", perms="0700") }}}

rationale: |-
    etcd is a highly-available key-value store used by Kubernetes deployments for persistent
    storage of all of its REST API objects. This data directory should be protected from any
    unauthorized reads or writes. It should not be readable or writable by any group members
    or the world.

severity: medium

identifiers:
    cce@ocp4: CCE-84013-2

references:
    cis@ocp4: 1.1.11
    nerc-cip: CIP-003-8 R6,CIP-004-6 R3,CIP-007-3 R6.1
    nist: CM-6,CM-6(1)
    srg: SRG-APP-000516-CTR-001325

ocil_clause: '{{{ ocil_clause_file_permissions(file="/var/lib/etcd", perms="drwx------") }}}'

ocil: |-
    {{{ ocil_file_permissions(file="/var/lib/etcd", perms="drwx------") }}}

platform: ocp4-master-node

warnings:
    - dependency: |-
        This rule is only applicable for nodes that run the Etcd service.
        The aforementioned service is only running on the nodes labeled
        "master" by default.

template:
    name: file_permissions
    vars:
        filepath: /var/lib/etcd/member/
        filemode: '0700'
