documentation_complete: true


title: 'Limit Access to the Host IPC Namespace'

description: |-
    Containers should not be allowed access to the host's Interprocess Communication (IPC)
    namespace. To prevent containers from getting access to a host's
    IPC namespace, the appropriate Security Context Constraints (SCCs)
    should set <tt>allowHostIPC</tt> to <tt>false</tt>.

rationale: |-
    A container running in the host's IPC namespace can use IPC
    to interact with processes outside the container potentially
    allowing an attacker to exploit a host process thereby enabling an
    attacker to exploit other services.

severity: medium

identifiers:
    cce@ocp4: CCE-84042-1

references:
    cis@ocp4: 5.2.3
    nerc-cip: CIP-003-8 R6,CIP-004-6 R3,CIP-007-3 R6.1
    nist: CM-6,CM-6(1)
    pcidss: Req-2.2
    srg: SRG-APP-000516-CTR-001325

ocil_clause: 'allowHostIPC usage in SCCs needs review'

ocil: |-
    Inspect each SCC returned from running the following command:
    <pre>$ oc get scc</pre>
    Review each SCC for those that have <tt>allowHostIPC</tt> set to <tt>true</tt>.
    Next, examine the outputs of the following commands:
    <pre>$ oc describe roles --all-namespaces</pre>
    <pre>$ oc describe clusterroles</pre>
    For any role/clusterrole that reference the
    <tt>securitycontextconstraints</tt> resource with the <tt>resourceNames</tt>
    of the SCCs that have <tt>allowHostIPC</tt>, examine the associated
    rolebindings to account for the users that are bound to the role. Review the
    account to determine if <tt>allowHostIPC</tt> is truly required.

#template:
#    name: yamlfile_value
#    vars:
#        ocp_data: "true"
#        filepath: /apis/security.openshift.io/v1/securitycontextconstraints
#        yamlpath: ".items[:]['allowHostIPC']"
#        check_existence: "at_least_one_exists"
#        entity_check: "at least one"
#        values:
#          - type: "boolean"
#            value: "false"
