Skip to content

fix(cis-1.12): do not report FAIL for file permission checks when the file is absent #2127

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Eljees wants to merge 2 commits into
base: main
Choose a base branch
from
+268 −23
Open

fix(cis-1.12): do not report FAIL for file permission checks when the file is absent #2127

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
25e3dd6
fix(cis-1.12): do not report FAIL for file permission checks when the…
Eljees Jul 31, 2026
681a90a
fixup(cis-1.12): use bare stat with || true instead of existence guards
Eljees Aug 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
56 changes: 42 additions & 14 deletions cfg/cis-1.12/master.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,13 +10,15 @@ groups:
checks:
- id: 1.1.1
text: "Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)"
audit: "/bin/sh -c 'if test -e $apiserverconf; then stat -c permissions=%a $apiserverconf; fi'"
audit: "/bin/sh -c 'stat -c permissions=%a $apiserverconf || true'"
tests:
bin_op: or
test_items:
- flag: "permissions"
compare:
op: bitmask
value: "600"
- flag: "No such file or directory"
remediation: |
Run the below command (based on the file location on your system) on the
control plane node.
Expand All @@ -25,75 +27,87 @@ groups:

- id: 1.1.2
text: "Ensure that the API server pod specification file ownership is set to root:root (Automated)"
audit: "/bin/sh -c 'if test -e $apiserverconf; then stat -c %U:%G $apiserverconf; fi'"
audit: "/bin/sh -c 'stat -c %U:%G $apiserverconf || true'"
tests:
bin_op: or
test_items:
- flag: "root:root"
- flag: "No such file or directory"
remediation: |
Run the below command (based on the file location on your system) on the control plane node.
For example, chown root:root $apiserverconf
scored: true

- id: 1.1.3
text: "Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)"
audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c permissions=%a $controllermanagerconf; fi'"
audit: "/bin/sh -c 'stat -c permissions=%a $controllermanagerconf || true'"
tests:
bin_op: or
test_items:
- flag: "permissions"
compare:
op: bitmask
value: "600"
- flag: "No such file or directory"
remediation: |
Run the below command (based on the file location on your system) on the control plane node.
For example, chmod 600 $controllermanagerconf
scored: true

- id: 1.1.4
text: "Ensure that the controller manager pod specification file ownership is set to root:root (Automated)"
audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c %U:%G $controllermanagerconf; fi'"
audit: "/bin/sh -c 'stat -c %U:%G $controllermanagerconf || true'"
tests:
bin_op: or
test_items:
- flag: "root:root"
- flag: "No such file or directory"
remediation: |
Run the below command (based on the file location on your system) on the control plane node.
For example, chown root:root $controllermanagerconf
scored: true

- id: 1.1.5
text: "Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)"
audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c permissions=%a $schedulerconf; fi'"
audit: "/bin/sh -c 'stat -c permissions=%a $schedulerconf || true'"
tests:
bin_op: or
test_items:
- flag: "permissions"
compare:
op: bitmask
value: "600"
- flag: "No such file or directory"
remediation: |
Run the below command (based on the file location on your system) on the control plane node.
For example, chmod 600 $schedulerconf
scored: true

- id: 1.1.6
text: "Ensure that the scheduler pod specification file ownership is set to root:root (Automated)"
audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c %U:%G $schedulerconf; fi'"
audit: "/bin/sh -c 'stat -c %U:%G $schedulerconf || true'"
tests:
bin_op: or
test_items:
- flag: "root:root"
- flag: "No such file or directory"
remediation: |
Run the below command (based on the file location on your system) on the control plane node.
For example, chown root:root $schedulerconf
scored: true

- id: 1.1.7
text: "Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)"
audit: "/bin/sh -c 'if test -e $etcdconf; then find $etcdconf -name '*etcd*' | xargs stat -c permissions=%a; fi'"
audit: "/bin/sh -c 'stat -c permissions=%a $etcdconf || true'"
use_multiple_values: true
tests:
bin_op: or
test_items:
- flag: "permissions"
compare:
op: bitmask
value: "600"
- flag: "No such file or directory"
remediation: |
Run the below command (based on the file location on your system) on the control plane node.
For example,
Expand All @@ -102,11 +116,13 @@ groups:

- id: 1.1.8
text: "Ensure that the etcd pod specification file ownership is set to root:root (Automated)"
audit: "/bin/sh -c 'if test -e $etcdconf; then find $etcdconf -name '*etcd*' | xargs stat -c %U:%G; fi'"
audit: "/bin/sh -c 'stat -c %U:%G $etcdconf || true'"
use_multiple_values: true
tests:
bin_op: or
test_items:
- flag: "root:root"
- flag: "No such file or directory"
remediation: |
Run the below command (based on the file location on your system) on the control plane node.
For example,
Expand Down Expand Up @@ -189,14 +205,16 @@ groups:
- id: 1.1.13
text: "Ensure that the default administrative credential file permissions are set to 600 (Automated)"
audit: |
for adminconf in /etc/kubernetes/admin.conf /etc/kubernetes/super-admin.conf; do if test -e $adminconf; then stat -c "permissions=%a %n" $adminconf; fi; done
for adminconf in /etc/kubernetes/admin.conf /etc/kubernetes/super-admin.conf; do stat -c "permissions=%a %n" $adminconf; done || true
use_multiple_values: true
tests:
bin_op: or
test_items:
- flag: "permissions"
compare:
op: bitmask
value: "600"
- flag: "No such file or directory"
remediation: |
Run the below command (based on the file location on your system) on the control plane node.
For example, chmod 600 /etc/kubernetes/admin.conf
Expand All @@ -207,14 +225,16 @@ groups:
- id: 1.1.14
text: "Ensure that the default administrative credential file ownership is set to root:root (Automated)"
audit: |
for adminconf in /etc/kubernetes/admin.conf /etc/kubernetes/super-admin.conf; do if test -e $adminconf; then stat -c "ownership=%U:%G %n" $adminconf; fi; done
for adminconf in /etc/kubernetes/admin.conf /etc/kubernetes/super-admin.conf; do stat -c "ownership=%U:%G %n" $adminconf; done || true
use_multiple_values: true
tests:
bin_op: or
test_items:
- flag: "ownership"
compare:
op: eq
value: "root:root"
- flag: "No such file or directory"
remediation: |
Run the below command (based on the file location on your system) on the control plane node.
For example, chown root:root /etc/kubernetes/admin.conf
Expand All @@ -224,13 +244,15 @@ groups:

- id: 1.1.15
text: "Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated)"
audit: "/bin/sh -c 'if test -e $schedulerkubeconfig; then stat -c permissions=%a $schedulerkubeconfig; fi'"
audit: "/bin/sh -c 'stat -c permissions=%a $schedulerkubeconfig || true'"
tests:
bin_op: or
test_items:
- flag: "permissions"
compare:
op: bitmask
value: "600"
- flag: "No such file or directory"
remediation: |
Run the below command (based on the file location on your system) on the control plane node.
For example,
Expand All @@ -239,10 +261,12 @@ groups:

- id: 1.1.16
text: "Ensure that the scheduler.conf file ownership is set to root:root (Automated)"
audit: "/bin/sh -c 'if test -e $schedulerkubeconfig; then stat -c %U:%G $schedulerkubeconfig; fi'"
audit: "/bin/sh -c 'stat -c %U:%G $schedulerkubeconfig || true'"
tests:
bin_op: or
test_items:
- flag: "root:root"
- flag: "No such file or directory"
remediation: |
Run the below command (based on the file location on your system) on the control plane node.
For example,
Expand All @@ -251,13 +275,15 @@ groups:

- id: 1.1.17
text: "Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated)"
audit: "/bin/sh -c 'if test -e $controllermanagerkubeconfig; then stat -c permissions=%a $controllermanagerkubeconfig; fi'"
audit: "/bin/sh -c 'stat -c permissions=%a $controllermanagerkubeconfig || true'"
tests:
bin_op: or
test_items:
- flag: "permissions"
compare:
op: bitmask
value: "600"
- flag: "No such file or directory"
remediation: |
Run the below command (based on the file location on your system) on the control plane node.
For example,
Expand All @@ -266,10 +292,12 @@ groups:

- id: 1.1.18
text: "Ensure that the controller-manager.conf file ownership is set to root:root (Automated)"
audit: "/bin/sh -c 'if test -e $controllermanagerkubeconfig; then stat -c %U:%G $controllermanagerkubeconfig; fi'"
audit: "/bin/sh -c 'stat -c %U:%G $controllermanagerkubeconfig || true'"
tests:
bin_op: or
test_items:
- flag: "root:root"
- flag: "No such file or directory"
remediation: |
Run the below command (based on the file location on your system) on the control plane node.
For example,
Expand Down
30 changes: 21 additions & 9 deletions cfg/cis-1.12/node.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,26 +10,28 @@ groups:
checks:
- id: 4.1.1
text: "Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)"
audit: '/bin/sh -c ''if test -e $kubeletsvc; then stat -c permissions=%a $kubeletsvc; fi'' '
audit: '/bin/sh -c "stat -c permissions=%a $kubeletsvc || true"'
tests:
bin_op: or
test_items:
- flag: "permissions"
compare:
op: bitmask
value: "600"
- flag: "No such file or directory"
remediation: |
Run the below command (based on the file location on your system) on the each worker node.
For example, chmod 600 $kubeletsvc
scored: true

- id: 4.1.2
text: "Ensure that the kubelet service file ownership is set to root:root (Automated)"
audit: '/bin/sh -c "if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; else echo \"File not found\"; fi"'
audit: '/bin/sh -c "stat -c %U:%G $kubeletsvc || true"'
tests:
bin_op: or
test_items:
- flag: root:root
- flag: "File not found"
- flag: "No such file or directory"
remediation: |
Run the below command (based on the file location on your system) on the each worker node.
For example,
Expand All @@ -38,7 +40,7 @@ groups:

- id: 4.1.3
text: "If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Manual)"
audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c permissions=%a $proxykubeconfig; fi'' '
audit: '/bin/sh -c "stat -c permissions=%a $proxykubeconfig || true"'
tests:
bin_op: or
test_items:
Expand All @@ -47,6 +49,7 @@ groups:
compare:
op: bitmask
value: "600"
- flag: "No such file or directory"
remediation: |
Run the below command (based on the file location on your system) on the each worker node.
For example,
Expand All @@ -55,25 +58,28 @@ groups:

- id: 4.1.4
text: "If proxy kubeconfig file exists ensure ownership is set to root:root (Manual)"
audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c %U:%G $proxykubeconfig; fi'' '
audit: '/bin/sh -c "stat -c %U:%G $proxykubeconfig || true"'
tests:
bin_op: or
test_items:
- flag: root:root
- flag: "No such file or directory"
remediation: |
Run the below command (based on the file location on your system) on the each worker node.
For example, chown root:root $proxykubeconfig
scored: false

- id: 4.1.5
text: "Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated)"
audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c permissions=%a $kubeletkubeconfig; fi'' '
audit: '/bin/sh -c "stat -c permissions=%a $kubeletkubeconfig || true"'
tests:
bin_op: or
test_items:
- flag: "permissions"
compare:
op: bitmask
value: "600"
- flag: "No such file or directory"
remediation: |
Run the below command (based on the file location on your system) on the each worker node.
For example,
Expand All @@ -82,10 +88,12 @@ groups:

- id: 4.1.6
text: "Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated)"
audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c %U:%G $kubeletkubeconfig; fi'' '
audit: '/bin/sh -c "stat -c %U:%G $kubeletkubeconfig || true"'
tests:
bin_op: or
test_items:
- flag: root:root
- flag: "No such file or directory"
remediation: |
Run the below command (based on the file location on your system) on the each worker node.
For example,
Expand Down Expand Up @@ -128,24 +136,28 @@ groups:

- id: 4.1.9
text: "If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Automated)"
audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c permissions=%a $kubeletconf; fi'' '
audit: '/bin/sh -c "stat -c permissions=%a $kubeletconf || true"'
tests:
bin_op: or
test_items:
- flag: "permissions"
compare:
op: bitmask
value: "600"
- flag: "No such file or directory"
remediation: |
Run the following command (using the config file location identified in the Audit step)
chmod 600 $kubeletconf
scored: true

- id: 4.1.10
text: "If the kubelet config.yaml configuration file is being used validate file ownership is set to root:root (Automated)"
audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c %U:%G $kubeletconf; fi'' '
audit: '/bin/sh -c "stat -c %U:%G $kubeletconf || true"'
tests:
bin_op: or
test_items:
- flag: root:root
- flag: "No such file or directory"
remediation: |
Run the following command (using the config file location identified in the Audit step)
chown root:root $kubeletconf
Expand Down
Loading