Admission of containers with capabilities assigned is not limited misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_K8S_37
Category - Subcategory	Kubernetes - Access Control
Provider	OTHER
Severity	LOW
Framework	Helm, Kubernetes, Kustomize, Terraform, Terraform Plan

Impact

Docker has a default list of capabilities that are allowed for each container of a pod. The containers use the capabilities from this default list, but pod manifest authors can alter it by requesting additional capabilities, or dropping some of the default capabilities. Limiting the admission of containers with capabilities ensures that only a small number of containers have extended capabilities outside the default range. This helps ensure that if a container becomes compromised it is unable to provide a productive path for an attacker to move laterally to other containers in the pod.

How to Fix

Resource: Container

• Arguments: securityContext:capabilities:drop (Optional)

Capabilities field allows granting certain privileges to a process without granting all the privileges of the root user. when drop includes ALL, all of the root privileges are disabled for that container. [source,go]

apiVersion: v1 kind: Pod metadata: name: spec: containers:

• name: image: securityContext: capabilities: drop:
• • ALL

---