seccomp profile is not set to Docker/Default or Runtime/Default misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_K8S_32
Category - Subcategory	Kubernetes - Access Control
Provider	OTHER
Severity	LOW
Framework	Helm, Kubernetes, Kustomize, Terraform, Terraform Plan

Impact

Secure computing mode (seccomp) is a Linux kernel feature used to restrict actions available within the container. The seccomp() system call operates on the seccomp state of the calling process. The default seccomp profile provides a reliable setting for running containers with seccomp and disables non-essential system calls.

How to Fix

Resource: Pod / Deployment / DaemonSet / StatefulSet / ReplicaSet / ReplicationController / Job / CronJob

• Arguments: metadata:annotations (Optional) Annotations attach arbitrary non-identifying metadata to objects. [source,go]

---

apiVersion: v1 kind: Pod metadata: name: annotations:

• seccomp.security.alpha.kubernetes.io/pod: "docker/default" or
• seccomp.security.alpha.kubernetes.io/pod: "runtime/default"

---

apiVersion: batch/v1beta1 kind: CronJob metadata: name: spec: schedule: <> jobTemplate: spec: template: metadata: annotations:

• seccomp.security.alpha.kubernetes.io/pod: "docker/default" or
• seccomp.security.alpha.kubernetes.io/pod: "runtime/default"

---

apiVersion: <> kind: metadata: name: spec: template: metadata: annotations:

• seccomp.security.alpha.kubernetes.io/pod: "docker/default" or
• seccomp.security.alpha.kubernetes.io/pod: "runtime/default"

---