Details
Audit all Docker daemon activities.
Rationale:
Apart from auditing your regular Linux file system and system calls, audit Docker daemon as well. Docker daemon runs with ‘root’ privileges. It is thus necessary to audit its activities and usage.
Solution
Add a rule for Docker daemon.
For example,
Add the line as below line in /etc/audit/audit.rules file:
-w /usr/bin/docker -k docker
Then, restart the audit daemon. For example,
service auditd restart
Impact:
Auditing generates quite big log files. Ensure to rotate and archive them periodically. Also, create a separate partition of audit to avoid filling root file system.
Default Value:
By default, Docker daemon is not audited.
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: Audit and Accountability.This control applies to the following type of system Unix.