Ensure Host UTS Namespace Is Not Shared (CIS 5.21)

​

Impact & Risk Analysis

• Severity: Medium
• CIS Benchmark: CIS 5.21
• Impact: Hostname Modification. The UTS namespace isolates the system identifiers: hostname and NIS domain name. If a container shares the host’s UTS namespace, it has full permission to change the hostname of the host server. This can cause confusion for system administration, break hostname-based authentication, or disrupt logging systems that rely on accurate hostnames.

​

Common Misconfiguration

​

Vulnerable Example

# Vulnerable docker-compose.yml
version: '3.8'
services:
  web:
    image: nginx:latest
    # VULNERABLE: Container shares the host UTS namespace
    uts: host

# Vulnerable Docker Run Command
# The --uts=host flag disables UTS isolation
docker run --rm --interactive --tty --uts=host rhel7.2

​

Secure Example

# Secure docker-compose.yml
version: '3.8'
services:
  web:
    image: nginx:latest
    # SECURE: Do not define 'uts: host'.
    # Default behavior creates a separate UTS namespace.

# Secure Docker Run Command
# Standard isolation
docker run -d nginx:latest

​

Audit Procedure

docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: UTSMode={{ .HostConfig.UTSMode }}'

• Result: Check the UTSMode value for each container.
• Fail: If it returns host.
• Pass: If it returns an empty string (indicating private namespace).

​

Remediation