
title: 'Profiling is protected by RBAC'

description: |-
  Ensure that the cluster-debugger cluster role includes the /debug/pprof
  resource URL. This demonstrates that profiling is protected by RBAC, with a
  specific cluster role to allow access.

rationale: |-
  Profiling allows for the identification of specific performance bottlenecks.
  It generates a significant amount of program data that could potentially be
  exploited to uncover system and program details. If you are not experiencing
  any bottlenecks and do not need the profiler for troubleshooting purposes, it
  is recommended to turn it off to reduce the potential attack surface. To
  ensure the collected data is not exploited, profiling endpoints are secured
  via RBAC (see cluster-debugger role). By default, the profiling endpoints are
  accessible only by users bound to cluster-admin or cluster-debugger role.
  Profiling can not be disabled.

identifiers:
  cce@ocp4: CCE-84182-5

references:
  cis@ocp4: 1.3.1
  nerc-cip: CIP-003-8 R6,CIP-004-6 R3,CIP-007-3 R6.1
  nist: CM-6,CM-6(1)
  pcidss: Req-2.2
  srg: SRG-APP-000516-CTR-001325

severity: medium

ocil_clause: |-
    The <tt>cluster-debugger</tt> role isn't protecting <tt>/debug/pprof</tt>

ocil: |-
    To verify that the <tt>cluster-debugger</tt> role is configured correctly,
    run the following command:
    <pre>$ oc get clusterroles cluster-debugger -o jsonpath='{.rules[0].nonResourceURLs}'</pre>
    and verify that the <tt>/debug/pprof</tt> path is included there.

warnings:
- general: |-
    {{{ openshift_cluster_setting("/apis/rbac.authorization.k8s.io/v1/clusterroles/cluster-debugger") | indent(4) }}}

template:
  name: yamlfile_value
  vars:
    ocp_data: "true"
    filepath: /apis/rbac.authorization.k8s.io/v1/clusterroles/cluster-debugger
    yamlpath: '.rules[0].nonResourceURLs[:]'
    entity_check: 'at least one'
    values:
    - value: '\/debug\/pprof'
      operation: 'pattern match'
      entity_check: 'at least one'
