Details

Verify that the Docker socket file is owned by ‘root’ and group-owned by ‘docker’.Docker daemon runs as ‘root’. The default Unix socket hence must be owned by ‘root’. If

any other user or process owns this socket, then it might be possible for that non-

privileged user or process to interact with Docker daemon. Also, such a non-privileged user

or process might interact with containers. This is neither secure nor desired behavior.Additionally, the Docker installer creates a Unix group called ‘docker’. You can add users to

this group, and then those users would be able to read and write to default Docker Unix

socket. The membership to the ‘docker’ group is tightly controlled by the system

administrator. If any other group owns this socket, then it might be possible for members

of that group to interact with Docker daemon. Also, such a group might not be as tightly

controlled as the ‘docker’ group. This is neither secure nor desired behavior.Hence, the default Docker Unix socket file must be owned by ‘root’ and group-owned by

‘docker’ to maintain the integrity of the socket file.

Solution

chown root-docker /var/run/docker.sock
This would set the ownership to ‘root’ and group-ownership to ‘docker’ for default Docker
socket file.
Impact-None.Default Value-By default, the ownership and group-ownership for Docker socket file is correctly set to
‘root-docker’.

Supportive Information

The following resource is also helpful.

• https://workbench.cisecurity.org/files/517

This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system Unix.

References

• 800-53|CM-6b.

Source

• Tenable.com/audits