Docker CIS 5.19: Ensure mount propagation mode is not enabled

No violationsstackroxmediumdeploy

Mount propagation mode allows mounting container volumes in Bidirectional, Host to Container, and None modes. Do not use Bidirectional mount propagation mode unless explicitly needed.

Rationale: A Bidirectional mount is replicated at all mounts and changes made at any mount point are propagated to all other mount points. Mounting a volume in Bidirectional mode does not restrict any other container from mounting and making changes to that volume. As this is likely not a desirable option from a security standpoint, this feature should not be used unless explicitly required
Remediation: Do not mount volumes in Bidirectional propagation mode.

CategoriesDocker CIS

Compliance mappingsView coverage →

DORA EU 2022/2554: Art. 9.2
ISO/IEC 27001 2022: A.8.9
NIST SP 800-53 rev. 5: CM-2
PCI DSS 4.0: 2.2.1

Generated artifacts

3 of 5 targets supported

docker-cis-5-19-ensure-mount-propagation-mode-is-not-enabled.yaml

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: docker-cis-5-19-ensure-mount-propagation-mode-is-not-enabled
  annotations:
    policies.kyverno.io/title: "Docker CIS 5.19: Ensure mount propagation mode is not enabled"
    policies.kyverno.io/category: Docker CIS
    policies.kyverno.io/severity: medium
    policies.kyverno.io/description: Mount propagation mode allows mounting container volumes in Bidirectional, Host to Container, and None modes. Do not use Bidirectional mount propagation mode unless explicitly needed.
    policies.kyverno.io/remediation: Do not mount volumes in Bidirectional propagation mode.
    policies.kyverno.io/rationale: A Bidirectional mount is replicated at all mounts and changes made at any mount point are propagated to all other mount points. Mounting a volume in Bidirectional mode does not restrict any other container from mounting and making changes to that volume. As this is likely not a desirable option from a security standpoint, this feature should not be used unless explicitly required
    policies.io/source: stackrox
    policies.io/source-id: 32d770b9-c6ba-4398-b48a-0c3e807644ed
spec:
  validationFailureAction: Audit
  background: true
  rules:
    - name: docker-cis-5-19-ensure-mount-propagation-mode-is-n
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
        message: 'Policy "Docker CIS 5.19: Ensure mount propagation mode is not enabled" violated: Mount propagation mode allows mounting container volumes in Bidirectional, Host to Container, and None modes. Do not use Bidirectional mount propagation mode unless explicitly needed.'
        deny:
          conditions:
            all:
              - key: "{{ request.object.spec.containers[].volumeMounts[].mountPropagation || `[]` }}"
                operator: AnyIn
                value:
                  - BIDIRECTIONAL
      exclude:
        any:
          - resources:
              namespaces:
                - kube-system
          - resources:
              namespaces:
                - kube-system
          - resources:
              namespaces:
                - openshift-cluster-csi-drivers

IR (canonical)

{
  "id": "32d770b9-c6ba-4398-b48a-0c3e807644ed",
  "name": "Docker CIS 5.19: Ensure mount propagation mode is not enabled",
  "description": "Mount propagation mode allows mounting container volumes in Bidirectional, Host to Container, and None modes. Do not use Bidirectional mount propagation mode unless explicitly needed.",
  "rationale": "A Bidirectional mount is replicated at all mounts and changes made at any mount point are propagated to all other mount points. Mounting a volume in Bidirectional mode does not restrict any other container from mounting and making changes to that volume. As this is likely not a desirable option from a security standpoint, this feature should not be used unless explicitly required",
  "remediation": "Do not mount volumes in Bidirectional propagation mode.",
  "severity": "medium",
  "categories": [
    "Docker CIS"
  ],
  "lifecycle": [
    "deploy"
  ],
  "eventSource": "none",
  "scope": [],
  "exclusions": [
    {
      "name": "csi-azuredisk-node",
      "namespace": "kube-system"
    },
    {
      "name": "csi-azurefile-node",
      "namespace": "kube-system"
    },
    {
      "name": "Don't alert on openshift-cluster-csi-drivers namespace",
      "namespace": "openshift-cluster-csi-drivers"
    },
    {
      "name": "pdcsi-node"
    }
  ],
  "enforcement": {
    "failBuild": false
  },
  "expression": {
    "op": "criterion",
    "field": "mount-propagation",
    "values": [
      "BIDIRECTIONAL"
    ],
    "valuesOp": "or",
    "negate": false
  },
  "disabled": false
}

Original StackRox JSON

{
  "id": "32d770b9-c6ba-4398-b48a-0c3e807644ed",
  "name": "Docker CIS 5.19: Ensure mount propagation mode is not enabled",
  "description": "Mount propagation mode allows mounting container volumes in Bidirectional, Host to Container, and None modes. Do not use Bidirectional mount propagation mode unless explicitly needed.",
  "rationale": "A Bidirectional mount is replicated at all mounts and changes made at any mount point are propagated to all other mount points. Mounting a volume in Bidirectional mode does not restrict any other container from mounting and making changes to that volume. As this is likely not a desirable option from a security standpoint, this feature should not be used unless explicitly required",
  "remediation": "Do not mount volumes in Bidirectional propagation mode.",
  "disabled": false,
  "categories": [
    "Docker CIS"
  ],
  "lifecycleStages": [
    "DEPLOY"
  ],
  "eventSource": "NOT_APPLICABLE",
  "exclusions": [
    {
      "name": "Don't alert on deployment csi-azuredisk-node in kube-system namespace",
      "deployment": {
        "name": "csi-azuredisk-node",
        "scope": {
          "cluster": "",
          "namespace": "kube-system",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment csi-azurefile-node in kube-system namespace",
      "deployment": {
        "name": "csi-azurefile-node",
        "scope": {
          "cluster": "",
          "namespace": "kube-system",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on openshift-cluster-csi-drivers namespace",
      "deployment": {
        "name": "",
        "scope": {
          "cluster": "",
          "namespace": "openshift-cluster-csi-drivers",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on a pdcsi-node deployment",
      "deployment": {
        "name": "pdcsi-node",
        "scope": null
      },
      "image": null
    }
  ],
  "scope": [],
  "severity": "MEDIUM_SEVERITY",
  "enforcementActions": [],
  "policySections": [
    {
      "sectionName": "Section 1",
      "policyGroups": [
        {
          "fieldName": "Mount Propagation",
          "booleanOperator": "OR",
          "negate": false,
          "values": [
            {
              "value": "BIDIRECTIONAL"
            }
          ]
        }
      ]
    }
  ],
  "notifiers": [],
  "lastUpdated": "2021-01-19T22:26:36.455422100Z",
  "SORTName": "",
  "SORTLifecycleStage": "",
  "SORTEnforcement": false,
  "policyVersion": "1.1",
  "mitreAttackVectors": [],
  "criteriaLocked": true,
  "mitreVectorsLocked": true,
  "isDefault": true,
  "source": "IMPERATIVE"
}