Skip to content

SEC-007.md

Latest commit

 

History

History
31 lines (18 loc) · 942 Bytes

SEC-007.md

File metadata and controls

31 lines (18 loc) · 942 Bytes

SEC-007 Container allows privilege escalation

Summary

A container has allowPrivilegeEscalation: true (or unset, which defaults to true). This allows processes to gain more privileges than the parent and can aid container escape.

Severity

Warning

Example

N/A

Symptoms

  • Report shows: Container <name> allows privilege escalation
  • securityContext.allowPrivilegeEscalation is true or not set

Resolution

  1. Set allowPrivilegeEscalation: false unless the workload has a documented need
  2. Combine with runAsNonRoot and dropped capabilities for defense in depth
  3. Use Pod Security Standards (e.g. restricted) to enforce false by default
  4. Audit existing pods and fix or justify exceptions

References