Containers share host process ID namespace misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_K8S_17
Category - Subcategory	Kubernetes - Access Control
Provider	OTHER
Severity	MEDIUM
Framework	Helm, Kubernetes, Kustomize, Terraform, Terraform Plan

Impact

Namespaces provide isolation for running processes and limit access to system resources, without the running process agnostic to its limitations. To limit an attacker's options to escalate privileges from within a container, we recommend you configure containers to refrain from sharing the host process ID namespace.

How to Fix

Resource: Pod / Deployment / DaemonSet / StatefulSet / ReplicaSet / ReplicationController / Job / CronJob

• Arguments: hostPID (Optional) If true, the Pod uses the host's PID namespace.

Default to false. [source,go]

apiVersion: v1 kind: Pod metadata: name: spec:

• hostPID: true

---