CIS 1.9 Control Node Checks 1.1.13, 1.1.14 show fail with correct permissions/ownership. no actual output reported

[btray900]

Overview

CIS 1.9 implements a permission and ownership check for /etc/kubernetes/admin.conf and /etc/kubernetes/super-admin.conf.

The tested control node shows 600 for both files, as well as root:root ownership but the check is reporting FAIL for both 1.1.13 and 1.1.14 in master.yaml for cis-1.9

Also CIS 1.9 master.yaml 1.1.14 has an incorrect remediation path (chmod versus chown) for super-admin.conf.

How did you run kube-bench?

kube-bench --benchmark cis-1.9 --json

What happened?

Permissions and ownership are correct, but benchmark reports FAIL.

Actual output is not captured for CIS-1.9

[Comparison] Actual output was captured as expected for CIS-1.8

What did you expect to happen:

The tests would pass due to the correct permissions and ownership for the admin.conf and super-admin.conf on Kubernetes 1.29.4

Environment

kube-bench: v0.8.0
kubernetes: 1.29.4

[btray900]

I notice the CIS-1.9 master.yaml 1.1.14 test uses /tmp for the path to confs in the audit section, /etc/kubernetes is the actual path on the controller tested.

[mozillazg]

@btray900 Thanks for reporting.

• For 1.1.13, Could you please attach the debug logs? (via kube-bench --benchmark cis-1.9 -c 1.1.13 -v 3)
• For 1.1.14, Yes, it looks like is a typo.

[btray900]

Debug for 1.1.13 attached, @mozillazg
kb_1_1_13_debug.txt

[mozillazg]

@btray900 Please changes

kube-bench/cfg/cis-1.9/master.yaml

Line 192 in 5a3fd1d

for adminconf in /etc/kubernetes/{admin.conf,super-admin.conf}; do if test -e $adminconf; then stat -c \"permissions=%a %n\" $adminconf; fi; done

to

for adminconf in /etc/kubernetes/admin.conf /etc/kubernetes/super-admin.conf; do if test -e $adminconf; then stat -c "permissions=%a %n" $adminconf; fi; done

kube-bench/cfg/cis-1.9/master.yaml

Line 210 in 5a3fd1d

for adminconf in /tmp/{admin.conf,super-admin.conf}; do if test -e $adminconf; then stat -c "ownership=%U:%G %n" $adminconf; fi; done

to

for adminconf in /etc/kubernetes/admin.conf /etc/kubernetes/super-admin.conf; do if test -e $adminconf; then stat -c "ownership=%U:%G %n" $adminconf; fi; done

then try again.

[andypitcher]

@btray900 nice catch thanks.
@mozillazg I can make a PR to fix this up if needed.

[mozillazg]

@andypitcher Feel free to send a pull request. Thanks!