Admission of root containers not minimized misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_K8S_23
Category - Subcategory	Kubernetes - Access Control
Provider	OTHER
Severity	MEDIUM
Framework	Helm, Kubernetes, Kustomize

Impact

Containers rely on the traditional Unix security model granting explicit and implicit permissions to resources, through permissions granted to users and groups. User namespaces are not enabled in Kubernetes. The container's user ID table maps to the host's user table, and running a process as the root user inside a container runs it as root on the host. Although possible, we do not recommend running as root inside the container. Containers that run as root usually have far more permissions than their workload requires. In case of compromise, an attacker can use these permissions to further an attack on the network. Several container images use the root user to run PID 1. An attacker will have root permissions in the container and be able to exploit mis-configurations.

How to Fix

Resource: Pod / Deployment / DaemonSet / StatefulSet / ReplicaSet / ReplicationController / Job / CronJob

• Arguments: runAsNonRoot (Optional) If true, Requires the container to run without root privileges. Default to false. runAsUser (Optional) If user number is anything other than 0, requires the container to run with that user id, which is not root. [source,go]

---

apiVersion: v1 kind: Pod metadata: name: spec: securityContext:

• runAsNonRoot: true
• runAsUser:

---

apiVersion: batch/v1beta1 kind: CronJob metadata: name: spec: schedule: <> jobTemplate: spec: template: spec: securityContext:

• runAsNonRoot: true
• runAsUser:

---

apiVersion: <> kind: metadata: name: spec: template: spec: securityContext:

• runAsNonRoot: true
• runAsUser:

---