Skip to main content

Scheduler Configuration File Permissions Are Restrictive

More Info:​

Ensure that the scheduler.conf file has permissions of 644 or more restrictive

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every control plane node, check the current permissions of the scheduler configuration file:

    stat -c permissions=%a /etc/kubernetes/scheduler.conf

  2. On every control plane node, set the file permissions to 644 as required:

    chmod 644 /etc/kubernetes/scheduler.conf

  3. On every control plane node, optionally confirm the file owner and group (adjust with chown if needed according to your standard, e.g., root:root):

    stat -c 'owner=%U group=%G' /etc/kubernetes/scheduler.conf

  4. On every control plane node, verify the fix using the audit command:

    /bin/sh -c 'if test -e /etc/kubernetes/scheduler.conf; then stat -c permissions=%a /etc/kubernetes/scheduler.conf; fi'

    Ensure the output shows permissions=644 (or a more restrictive value such as 640 or 600).

Using kubectl

kubectl cannot modify file permissions on control plane nodes, so it cannot be used to fix this finding on /etc/kubernetes/scheduler.conf. The required change must be made directly on every control plane node’s filesystem; see the Manual Steps section for the exact commands to run.

Automation
#!/usr/bin/env bash
#
# Automation: Fix permissions for /etc/kubernetes/scheduler.conf
# Scope: Run on every control plane node
# Idempotent: Safe to re-run; only adjusts permissions if needed.

set -euo pipefail

SCHED_CONF="/etc/kubernetes/scheduler.conf"
DESIRED_MODE="644"

echo "=== Checking for ${SCHED_CONF} ==="
if [ ! -e "${SCHED_CONF}" ]; then
  echo "File not found: ${SCHED_CONF} (nothing to do on this node)"
  exit 0
fi

# Get current permissions (numeric, e.g. 640, 644, 600)
CURRENT_MODE="$(stat -c '%a' "${SCHED_CONF}")"
echo "Current permissions: ${CURRENT_MODE}"

# Compare and only change if more permissive than desired
# Any mode numerically greater than 644 is considered more permissive here
if [ "${CURRENT_MODE}" != "${DESIRED_MODE}" ]; then
  echo "Setting permissions to ${DESIRED_MODE} on ${SCHED_CONF}"
  chmod "${DESIRED_MODE}" "${SCHED_CONF}"
else
  echo "Permissions already set to ${DESIRED_MODE}; no change needed"
fi

echo "=== Verifying remediation ==="
/bin/sh -c 'if test -e /etc/kubernetes/scheduler.conf; then stat -c permissions=%a /etc/kubernetes/scheduler.conf; fi'

Additional Reading:​