# Ensure that /etc/docker directory permissions are set to 755 or more restrictively

- Source: https://support.icompaas.com/support/solutions/articles/62000234335-ensure-that-etc-docker-directory-permissions-are-set-to-755-or-more-restrictively
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS Docker Benchmark v1.7.0](https://support.icompaas.com/support/solutions/62000112687) › [CIS Docker Benchmark](https://support.icompaas.com/support/solutions/folders/62000169241)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability:**

-   **Level 1**
    

**Description:**

The /etc/docker directory contains configuration files that are essential for Docker's operation. It is important to ensure that this directory has appropriate permissions to prevent unauthorized access or modifications, which could compromise Docker's security.

**Rationale:**

Setting the correct file permissions on the /etc/docker directory ensures that only authorized users (typically root) can access or modify Docker's configuration files. Improper permissions could allow unauthorized users to alter Docker's behavior or gain access to sensitive information.

**Impact:**

**Pros:**

-   Prevents unauthorized modifications to Docker configuration files, ensuring Docker’s integrity.
    
-   Enhances system security by limiting access to Docker’s operational settings.
    

**Cons:**

-   Misconfiguring permissions could lead to the inability of Docker or users to read or modify the configuration files.
    

**Default Value:**

The default permissions for /etc/docker are usually set to 755, allowing the owner (root) full control while restricting access to others.

**Pre-requisites:**

-   Administrative privileges on the Docker host system.
    
-   Basic understanding of Linux file permissions.
    

**Remediation**

**Test Plan:**

**Using AWS Console:**

1.  Log in to the EC2 instance running Docker.
    
2.  Verify the permissions of the /etc/docker directory:
    

**Using AWS CLI:**

1.  Connect to the EC2 instance where Docker is running.
    
2.  Run the following command to check the permissions of the /etc/docker directory:  
    
    ls -ld /etc/docker
    

**Implementation Plan:**

**Using AWS Console:**

1.  Log in to the EC2 instance.
    
2.  Set the correct permissions for the /etc/docker directory:
    
3.  Ensure that the directory is owned by root:
    

**Using AWS CLI:**

1.  Use SSM to modify the permissions and ownership of the /etc/docker directory:  
    
    aws ssm send-command --document-name "AWS-RunShellScript" --targets "Key=instanceIds,Values=instance\_id" --parameters 'commands=\["sudo chmod 755 /etc/docker && sudo chown root:root /etc/docker"\]'
    

**Backout Plan:**

**Using AWS Console:**

1.  Log in to the EC2 instance.
    
2.  Revert the permissions to the default settings if necessary:  
    
    sudo chmod 755 /etc/docker
    sudo chown root:root /etc/docker
    

**Using AWS CLI:**

1.  Use SSM to revert the permissions and ownership to the default settings:  
    
    aws ssm send-command --document-name "AWS-RunShellScript" --targets "Key=instanceIds,Values=instance\_id" --parameters 'commands=\["sudo chmod 755 /etc/docker && sudo chown root:root /etc/docker"\]'
    

**References:**

-   [Docker CLI Documentation  
      
    ](https://docs.docker.com/reference/cli/dockerd/#daemon-socket-option)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.