# Ensure Auditing is Configured for Docker Files and Directories - docker.sock

- Source: https://support.icompaas.com/support/solutions/articles/62000234297-ensure-auditing-is-configured-for-docker-files-and-directories-docker-sock
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS Docker Benchmark v1.7.0](https://support.icompaas.com/support/solutions/62000112687) › [CIS Docker Benchmark](https://support.icompaas.com/support/solutions/folders/62000169241)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability:**

-   **Level 2**  
    

**Description:**

The docker.sock file is a Unix domain socket used by the Docker daemon for communication with the Docker client. Auditing this file ensures that unauthorized access or modifications to this communication socket are detected.

**Rationale:**

The Docker daemon runs with root privileges, and any untrusted users with access to docker.sock can control Docker containers. By auditing this file, we can detect any unauthorized attempts to access or modify the Docker daemon’s communication channel.  

**Impact:**

**Pros:**  

-   Enhances security by monitoring the access and use of Docker's root-privileged communication socket.  
    
-   Provides critical insight into unauthorized or malicious activity aimed at exploiting Docker.  
      
    

**Cons:**  

-   Can generate a large volume of audit logs, which may require management (log rotation and archiving).  
    
-   May require setting up a separate partition for audit logs to avoid filling up critical system storage.  
    

**Default Value:**

By default, Docker-related files like docker.sock are not audited unless explicitly configured.

**Pre-requisites:**

-   Administrative access to the Docker host system.  
    
-   Familiarity with the configuration of auditd and audit rules.
    

**Remediation:**

**Test Plan:**

**Using AWS Console:**

1.  Log in to the EC2 instance running Docker.  
    
2.  Run the following command to check if there is an audit rule for docker.sock:  
    

-   auditctl -l | grep docker.sock
    

**Using AWS CLI:**

1.  Connect to the EC2 instance where Docker is running.  
    
2.  Run the following command to verify if an audit rule exists for docker.sock:  
    

-   auditctl -l | grep docker.sock
    

  

**Implementation Plan:**

**Using AWS Console:**

1.  Log in to the EC2 instance.  
    
2.  Add an audit rule for docker.sock by editing the /etc/audit/rules.d/audit.rules file:

-   \-w /var/run/docker.sock -k docker
    

      3. Restart the audit daemon to apply the changes:

-   sudo systemctl restart auditd
    

**Using AWS CLI:**

1.  Use SSM to remotely add the audit rule and restart the audit daemon:  
    

aws ssm send-command --document-name "AWS-RunShellScript" --targets "Key=instanceIds,Values=instance\_id" --parameters 'commands=\["echo \\'-w /var/run/docker.sock -k docker\\' >> /etc/audit/rules.d/audit.rules && sudo systemctl restart auditd"\]'

  

**Backout Plan:**

**Using AWS Console:**

1.  Log in to the EC2 instance.  
    
2.  Remove the audit rule by editing the /etc/audit/rules.d/audit.rules file and deleting the line:

-   \-w /var/run/docker.sock -k docker
    

      3. Restart the audit daemon to apply the changes:

-   sudo systemctl restart auditd
    

**Using AWS CLI:**

Use SSM to remotely remove the audit rule and restart the audit daemon:  

aws ssm send-command --document-name "AWS-RunShellScript" --targets "Key=instanceIds,Values=instance\_id" --parameters 'commands=\["sed -i \\'/\\-w \\/var\\/run\\/docker.sock -k docker/d\\' /etc/audit/rules.d/audit.rules && sudo systemctl restart auditd"\]'

  

**References:**

-   CIS Docker Benchmark v1.7  
    
-   [Docker Security Documentation](https://docs.docker.com/engine/security/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.