Cis Docker 5.2
DevOps & Securitycis-docker-5.2Cis Docker 5.2 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Ensure that, if applicable, an AppArmor Profile is enabled
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Server_Software/Docker/CIS_Docker_Benchmark_v1.8.0/cis-docker-5.2/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-docker-5-2, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
5.2 Ensure that, if applicable, an AppArmor Profile is enabled (Manual)
Profile Applicability
- Level 1 - Docker - Linux
Description
AppArmor is an effective and easy-to-use Linux application security system. It is available on some Linux distributions by default, for example, on Debian and Ubuntu.
Rationale
AppArmor protects the Linux OS and applications from various threats by enforcing a security policy which is also known as an AppArmor profile. You can create your own AppArmor profile for containers or use Docker's default profile. Enabling this feature enforces security policies on containers as defined in the profile.
Impact
The container will have the security controls defined in the AppArmor profile. It should be noted that if the AppArmor profile is misconfigured, this may cause issues with the operation of the container.
Audit Procedure
You should run the command below:
docker ps --quiet --all | xargs docker inspect --format='{{ .Id }}: AppArmorProfile={{ .AppArmorProfile }}'
This command should return a valid AppArmor Profile for each container instance.
Remediation
If AppArmor is applicable for your Linux OS, you should enable it.
- Verify AppArmor is installed.
- Create or import a AppArmor profile for Docker containers.
- Enable enforcement of the policy.
- Start your Docker container using the customized AppArmor profile. For example:
docker run --interactive --tty --security-opt="apparmor:PROFILENAME" ubuntu /bin/bash
Alternatively, Docker's default AppArmor policy can be used.
Default Value
By default, the docker-default AppArmor profile is applied to running containers. The Docker binary generates this profile and then loads it into the kernel.
References
- https://docs.docker.com/engine/security/apparmor/
- https://docs.docker.com/engine/reference/run/#security-configuration
- https://docs.docker.com/engine/security/#other-kernel-security-features
CIS Controls
v8
10.5 Enable Anti-Exploitation Features
Enable anti-exploitation features on enterprise assets and software, where possible, such as Microsoft® Data Execution Prevention (DEP), Windows® Defender Exploit Guard (WDEG), or Apple® System Integrity Protection (SIP) and Gatekeeper™.
v7
5.2 Maintain Secure Images
Maintain secure images or templates for all systems in the enterprise based on the organization's approved configuration standards. Any new system deployment or existing system that becomes compromised should be imaged using one of those images or templates.