Containers run with AllowPrivilegeEscalation based on Pod Security Policy setting misconfiguration d

Rule Details

Cortex AppSec Rule ID	APPSEC_K8S_5
Category - Subcategory	Kubernetes - Access Control
Provider	OTHER
Severity	MEDIUM
Framework	Helm, Kubernetes, Kustomize, Terraform, Terraform Plan

Impact

The AllowPrivilegeEscalation Pod Security Policy controls whether or not a user is allowed to set the security context of a container to True. Setting it to False ensures that no child process of a container can gain more privileges than its parent. We recommend you to set AllowPrivilegeEscalation to False, to ensure RunAsUser commands cannot bypass their existing sets of permissions.

How to Fix

Resource: Container

• Arguments: allowPrivilegeEscalation (Optional) If false, the pod can not request to allow privilege escalation. Default to true. [source,go]

---

apiVersion: v1 kind: Pod metadata: name: spec: containers:

• name: image: securityContext:
• allowPrivilegeEscalation: false

---