Container Network Interface File Permissions Should Be 600 Or More Restrictive

#!/usr/bin/env bash
#
# Harden CNI configuration and network state file permissions on all control plane nodes.
# Target: every control plane node (run locally on each node or via SSH/Ansible).
#
# Effect:
# - Sets CNI config files (kubelet --cni-conf-dir, default /etc/cni/net.d) to 600.
# - Sets CNI network state files under /var/lib/cni/networks to 600.
# Safe to re-run; only changes file modes.

set -euo pipefail

echo "[INFO] Detecting CNI configuration directory from kubelet arguments..."

# Try to extract --cni-conf-dir from kubelet process; fall back to default if not present.
CNI_CONF_DIR="$(
  ps -ef | grep kubelet | grep -v grep | \
    sed -n 's%.*--cni-conf-dir[= ]\([^ ]*\).*%\1%p' | head -n1
)"

if [[ -z "${CNI_CONF_DIR}" ]]; then
  # Common default used by most distros
  CNI_CONF_DIR="/etc/cni/net.d"
  echo "[INFO] --cni-conf-dir not explicitly set; falling back to default: ${CNI_CONF_DIR}"
else
  echo "[INFO] Found CNI configuration directory from kubelet: ${CNI_CONF_DIR}"
fi

if [[ ! -d "${CNI_CONF_DIR}" ]]; then
  echo "[WARN] CNI configuration directory does not exist: ${CNI_CONF_DIR}"
else
  echo "[INFO] Setting permissions to 600 for files in ${CNI_CONF_DIR} ..."
  # Only files, not directories; ignore errors if directory is empty.
  find "${CNI_CONF_DIR}" -mindepth 1 -maxdepth 1 -type f -print0 2>/dev/null | \
    xargs -0 --no-run-if-empty chmod 600
fi

CNI_STATE_DIR="/var/lib/cni/networks"
if [[ -d "${CNI_STATE_DIR}" ]]; then
  echo "[INFO] Setting permissions to 600 for CNI state files in ${CNI_STATE_DIR} ..."
  find "${CNI_STATE_DIR}" -type f -print0 2>/dev/null | \
    xargs -0 --no-run-if-empty chmod 600
else
  echo "[INFO] CNI state directory not present (ok): ${CNI_STATE_DIR}"
fi

echo "[INFO] Verifying resulting permissions..."

# Re-run the benchmark audit commands to confirm.

echo "[VERIFY] CNI configuration files:"
ps -ef | grep kubelet | grep -- --cni-conf-dir | \
  sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | \
  xargs -I{} find {} -mindepth 1 2>/dev/null | \
  xargs --no-run-if-empty stat -c '%n permissions=%a'

echo "[VERIFY] CNI network state files:"
find /var/lib/cni/networks -type f 2> /dev/null | \
  xargs --no-run-if-empty stat -c '%n permissions=%a'

echo "[INFO] Check that all listed permissions are 600 or more restrictive (e.g., 600, 400)."