documentation_complete: true


title: 'Verify Permissions on the Kubernetes Scheduler Pod Specification File'

description: |-
    {{{ describe_file_permissions(file="/etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/kube-scheduler-pod.yaml", perms="0644") }}}

rationale: |-
    If the Kubernetes specification file is writable by a group-owner or the
    world the risk of its compromise is increased. The file contains the configuration of
    an Kubernetes Scheduler service that is configured on the system. Protection of this file is
    critical for OpenShift security.

severity: medium

identifiers:
    cce@ocp4: CCE-84057-9

references:
    cis@ocp4: 1.1.5
    nerc-cip: CIP-003-8 R6,CIP-004-6 R3,CIP-007-3 R6.1
    nist: CM-6,CM-6(1)
    srg: SRG-APP-000516-CTR-001325

ocil_clause: '{{{ ocil_clause_file_permissions(file="/etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/kube-scheduler-pod.yaml", perms="-rw-r--r--") }}}'

ocil: |-
    {{{ ocil_file_permissions(file="/etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/kube-scheduler-pod.yaml", perms="-rw-r--r--") }}}

platform: ocp4-master-node

warnings:
  - dependency: |-
      This rule is only applicable for nodes that run the Kubernetes Scheduler service.
      The aforementioned service is only running on the nodes labeled
      "master" by default.

template:
    name: file_permissions
    vars:
        filepath: ^/etc/kubernetes/static-pod-resources/kube-scheduler-pod-.*/kube-scheduler-pod.yaml$
        filemode: '0644'
        filepath_is_regex: "true"
