Containers wishing to share host IPC namespace admitted misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_K8S_3
Category - Subcategory	Kubernetes - Access Control
Provider	OTHER
Severity	MEDIUM
Framework	Helm, Kubernetes, Kustomize, Terraform, Terraform Plan

Impact

The host IPC namespace controls whether a pod's containers can be shared. You can administer cluster-level restrictions to ensure that containers remain isolated using PodSecurityPolicy and ensuring hostIPC is set to False. Preventing sharing of host PID/IPC namespace, networking, and ports ensures proper isolation between Docker containers and the underlying host.

How to Fix

Resource: PodSecurityPolicy

• Arguments: hostIPC Determines if the policy allows the use of HostIPC in the pod spec.

To use a PodSecurityPolicy resource, the requesting user or target pod's service account must be authorized to use the policy. The preferred method is to grant access to the service account.

In the following example we use RBAC, a standard Kubernetes authorization mode.

A Role or ClusterRole must grant access to use the desired policies.

Kind: ClusterRole

The **ClusterRole **is then bound to the authorized service(s):

Kind: ClusterRoleBinding [source,go]

apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: spec:

• hostIPC: false

---

apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: rules:

• apiGroups: ['policy'] resources: ['podsecuritypolicies'] verbs: ['use'] resourceNames:

---

apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: roleRef: kind: ClusterRole name: apiGroup: rbac.authorization.k8s.io subjects:

• kind: ServiceAccount name: namespace:

---