Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

SRG-APP-000266-CTR-000625: Inherently met SRG Was missing status justification #10616

Merged
merged 1 commit into from
Jun 8, 2023
Merged

SRG-APP-000266-CTR-000625: Inherently met SRG Was missing status justification #10616

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions controls/srg_ctr/SRG-APP-000266-CTR-000625.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,3 +8,15 @@ controls:
related_rules:
- audit_profile_set
status: inherently met
status_justification: |-
In OpenShift, the logs depend greatly on the component. Some components would just write messages to stdout that the cluster administrator can retrieve logs through the use of the oc command. Some components emit events, and others emit a Prometheus metric which the API server would write into their logs.

For the OCP components that run in a container (most operators), the usual RBAC rules would prevent a non-admin user from reading the container logs or events.

OpenShift error message handling is designed to obscure or not log sensitive information which is contained inside Secrets.

Error Messages from applications will need to be reviewed independently as the messages provided by the application hosted on the platform is outside the scope of the platform control.
artifact_description: |-
Supporting evidence is in the following documentation:
https://docs.openshift.com/container-platform/latest/logging/cluster-logging-visualizer.html
https://docs.openshift.com/container-platform/latest/authentication/using-rbac.html