The 2.15 test that evaluates whether userland proxy is disabled will fail and return false positive when userland proxy is successfully disabled but the docker daemon is still passed an unused --userland-proxy-path
variable.
On Red Hat systems, this --userland-proxy-path
parameter is added to systemd config in /etc/systemd/system/multi-user.target.wants/docker.service
by default after docker-current package is installed:
--userland-proxy-path=/usr/libexec/docker/docker-proxy-current \
This path parameter does not take effect when userland proxy is diabled via edit to /etc/sysconfig/docker
file OPTIONS value to add --userland-proxy=false
, but the parameter still exists in the process list.
Based upon behavior of docker daemon, the 2.15 test should succeed despite existence of this parameter.
We can validate userland proxy is enabled or disabled independently of --userland-proxy=false
parameter check by creating container with published port and looking at process list.
We will see docker-proxy-current process listed (as own process and not as value to dockerd parameter) if userland proxy is enabled. We won't see the docker-proxy-current process if it is disabled:
This allows us to confirm userland proxy is still disabled despite existence of --userland-proxy-path
parameter.
with --userland-proxy=false
there's no docker-proxy-current
process:
# docker run --name test -d -p 8111:8111 alpine:latest sleep 100
84b607f157393e1fc2c7a3d50664627be65e725b8c8e46106f83a080151e1e6a
# ps -ef | grep proxy
root 23932 1 0 16:17 ? 00:00:06 /usr/bin/dockerd-current --add-runtime docker-runc=/usr/libexec/docker/docker-runc-current --default-runtime=docker-runc --authorization-plugin=rhel-push-plugin --exec-opt native.cgroupdriver=systemd --init-path=/usr/libexec/docker/docker-init-current **--userland-proxy-path=/usr/libexec/docker/docker-proxy-current** --seccomp-profile=/etc/docker/seccomp.json --selinux-enabled --log-driver=journald --signature-verification=false --userland-proxy=false --add-registry registry.access.redhat.com
root 27418 21811 0 16:56 pts/1 00:00:00 grep --color=auto proxy
with userland proxy enabled (no --userland-proxy
parameter passed, or with true value passed, eg, --userland-proxy=true
), the docker-proxy-current
process exists (PID 29148 below):
# docker run --name test -d -p 8111:8111 alpine:latest sleep 100
7032fb47a74c2769d3290fac704e232b8f9abca73b3d1d19aaa7871da2430744
# ps -ef | grep proxy
root 27974 1 3 16:57 ? 00:00:02 /usr/bin/dockerd-current --add-runtime docker-runc=/usr/libexec/docker/docker-runc-current --default-runtime=docker-runc --authorization-plugin=rhel-push-plugin --exec-opt native.cgroupdriver=systemd --init-path=/usr/libexec/docker/docker-init-current --userland-proxy-path=/usr/libexec/docker/docker-proxy-current --seccomp-profile=/etc/docker/seccomp.json --selinux-enabled --log-driver=journald --signature-verification=false --add-registry registry.access.redhat.com
root 29148 27974 0 16:58 ? 00:00:00 /usr/libexec/docker/docker-proxy-current -proto tcp -host-ip 0.0.0.0 -host-port 8111 -container-ip 172.17.0.3 -container-port 8111
root 29289 21811 0 16:58 pts/1 00:00:00 grep --color=auto proxy
Maybe it should look for whole parameter instead of looking for any parameter beginning with --userland-proxy
. Or perhaps check against --userland-proxy=
instead of --userland-proxy
if that won't interfere with the 'op: eq' specified in the yaml:
- id: 2.15
description: "Ensure Userland Proxy is Disabled (Scored)"
audit: ps -ef | grep dockerd
tests:
test_items:
- flag: "--userland-proxy"
compare:
op: eq
value: "false"
set: true
remediation: |
Run the Docker daemon as below:
dockerd --userland-proxy=false
scored: true
While there is no purpose for --userland-proxy-path
parameter to exist if it cannot take effect, the test should pass if userland proxy is successfully disabled on the host, and userland proxy is successfully disabled on the host even when this extra parameter exists.