CAP_SYS_ADMIN Linux capability is used misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_K8S_39
Category - Subcategory	Kubernetes - Access Control
Provider	OTHER
Severity	HIGH
Framework	Helm, Kubernetes, Kustomize, Terraform, Terraform Plan

Impact

Capabilities permit certain named root actions without giving full root access and are considered a fine-grained permissions model. We recommend all capabilities should be dropped from a pod, with only those required added back. There are a large number of capabilities, with CAP_SYS_ADMIN bounding most. CAP_SYS_ADMIN is a highly privileged access level equivalent to root access and should generally be avoided.

How to Fix

Resource: Container

• Arguments: securityContext:capabilities:add (Optional) Add capabilities field allows granting certain privileges to a process. [source,go]

---

apiVersion: v1 kind: Pod metadata: name: spec: containers:

• name: image: securityContext: capabilities: add:
• -SYS_ADMIN

---