Root containers admitted misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_K8S_6
Category - Subcategory	Kubernetes - Access Control
Provider	OTHER
Severity	MEDIUM
Framework	Helm, Kubernetes, Kustomize, Terraform, Terraform Plan

Impact

In Kubernetes, a container's user ID table maps to the host's user table. Running a process as the root user inside a container runs it as root on the host. Many container images use the root user to run PID 1. If PID 1 is compromised, an attacker has root permissions in the container, and any misconfigurations can be exploited. Containers that run as root frequently have more permissions than their workload requires which, in case of compromise, could help an attacker further their exploits.

How to Fix

Resource: PodSecurityPolicy

• Arguments: runAsUser:rule:MustRunAsNonRoot - Unable containers to run with root privileges. runAsUser:rule:MustRunAs - When the minimum range is set to 1 or higher, containers cannot run as root.

To use a PodSecurityPolicy resource, the requesting user or target pod's service account must be authorized to use the policy.

The preferred method is to grant access to the service account.

In the following example we use RBAC, a standard Kubernetes authorization mode.

A Role or ClusterRole needs to grant access to use the desired policies.

Kind: ClusterRole

The ClusterRole is bound to the authorized service(s):

Kind: ClusterRoleBinding [source,go]

apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: spec: runAsUser:

• rule: 'MustRunAsNonRoot' or rule: 'MustRunAs' ranges:

• • min: <min user, 1 or higher> max:

---

apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: rules:

• apiGroups: ['policy'] resources: ['podsecuritypolicies'] verbs: ['use'] resourceNames:

---

apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: roleRef: kind: ClusterRole name: apiGroup: rbac.authorization.k8s.io subjects:

• kind: ServiceAccount name: namespace:

---