V-233184

Discussion

Controlling access to those users and roles responsible for patching and updating the container platform reduces the risk of untested or potentially malicious software from being installed within the platform. This access may be separate from the access required to install container images into the registry and those access requirements required to instantiate an image into a service. Explicit privileges (escalated or administrative privileges) provide the regular user with explicit capabilities and control that exceeds the rights of a regular user.

Check Content

Review the container platform configuration to determine if patches and updates can only be installed through accounts with privileged status. 

Attempt to install a patch or upgrade using a nonprivileged user account. 

If patches or updates can be installed using a nonprivileged account or the container platform is not configured to stop the installation using a nonprivileged account, this is a finding.