Containers with NET_RAW capability admitted misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_K8S_7
Category - Subcategory	Kubernetes - Access Control
Provider	OTHER
Severity	LOW
Framework	Helm, Kubernetes, Kustomize, Terraform, Terraform Plan

Impact

NET_RAW is a default permissive setting in Kubernetes allowing ICMP traffic between containers and grants an application the ability to craft raw packets. In the hands of an attacker NET_RAW can enable a wide variety of networking exploits from within the cluster.

How to Fix

Resource: PodSecurityPolicy

• Arguments: requiredDropCapabilities (Optional) Defines the capabilities which must be dropped from containers.

These capabilities are removed from the default set, and must not be added. NET_RAW capability is removed when the field includes it specifically, or when it includes ALL.

To use a PodSecurityPolicy resource, the requesting user or target pod’s service account must be authorized to use the policy. The preferred method is to grant access to the service account. In the following example we use RBAC, a standard Kubernetes authorization mode.

First, a Role or ClusterRole needs to grant access to use the desired policies.

Kind: ClusterRole

The ClusterRole is then bound to the authorized service(s):

Kind: ClusterRoleBinding [source,go]

apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: spec: requiredDropCapabilities:

• -ALL or
• -NET_RAW

---

apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: rules:

• apiGroups: ['policy'] resources: ['podsecuritypolicies'] verbs: ['use'] resourceNames:

---

apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: roleRef: kind: ClusterRole name: apiGroup: rbac.authorization.k8s.io subjects:

• kind: ServiceAccount name: namespace:

---