---
title: The daemon.json file should have user and group ownership set to root
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > The daemon.json file should have user
  and group ownership set to root
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# The daemon.json file should have user and group ownership set to root
Classification:complianceFramework:cis-dockerControl:3.17 
## Description{% #description %}

The `daemon.json` file should be owned by user root and group root.

## Rationale{% #rationale %}

`daemon.json` sets the options of the Docker daemon. Its owner can change it, so the owner and group should be root only.

## Audit{% #audit %}

Find the file that dockerd takes with `--config-file`, then show the owner and group of that file and of `/etc/docker/daemon.json`:

```bash
ps -o args= -C dockerd
stat -c '%U:%G' /etc/docker/daemon.json
```

Datadog checks the file named by the `--config-file` flag of the dockerd command line, and `/etc/docker/daemon.json`. It passes the rule when every file found belongs to root:root, fails it when one belongs to another user or group, and reports it not applicable when there is none.

## Remediation{% #remediation %}

Set the owner and group of the file:

```bash
chown root:root /etc/docker/daemon.json
```

## Impact{% #impact %}

None.

## Default value{% #default-value %}

The file exists once the administrator creates it. When root writes it with the default umask, it has root:root and mode 644.

## References{% #references %}

1. [https://docs.docker.com/reference/cli/dockerd/#daemon-configuration-file](https://docs.docker.com/reference/cli/dockerd/#daemon-configuration-file)