← Policy catalog
</> ValidatingAdmissionPolicy · Apache-2.0

Permits Privilege Escalation

initcontainer-privilege-escalation

severityHigh resourceInitContainers productKubernetes bundles2

Leaving privilege escalation enabled lets a process in the init container gain more privileges than its parent through setuid binaries or file capabilities, turning a compromised unprivileged process into root inside the container.

Rejects unless

(has(object.spec.os) &&
 has(object.spec.os.name) &&
 object.spec.os.name.lowerAscii() == "windows") ||
!has(object.spec.initContainers) || object.spec.initContainers.all(ic,
  has(ic.securityContext) &&
  has(ic.securityContext.allowPrivilegeEscalation) &&
  ic.securityContext.allowPrivilegeEscalation == false
)

spec.initContainers[*].securityContext.allowPrivilegeEscalation must be set to false.

Remediation

Set allowPrivilegeEscalation to false in the security context of every init container. The field must be present explicitly, since omitting it also fails. Field: spec.initContainers[*].securityContext.allowPrivilegeEscalation.

Applies to

  • pods · v1 · CREATE, UPDATE

Manifest

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: initcontainer-privilege-escalation
  annotations:
    kubeapt.io/uuid: "65b9d865-f70b-4c45-bc91-077299c09b2c"
    security.kubeapt.io/displayName: "Permits Privilege Escalation"
    security.kubeapt.io/description: "Leaving privilege escalation enabled lets a process in the init container gain more privileges than its parent through setuid binaries or file capabilities, turning a compromised unprivileged process into root inside the container."
    security.kubeapt.io/resource: "InitContainers"
    security.kubeapt.io/severity: "High"
    security.kubeapt.io/remediation: "Set allowPrivilegeEscalation to false in the security context of every init container. The field must be present explicitly, since omitting it also fails. Field: spec.initContainers[*].securityContext.allowPrivilegeEscalation."
    security.kubeapt.io/product: "Kubernetes"
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
    - apiGroups:
      - ''
      apiVersions:
      - v1
      operations:
      - CREATE
      - UPDATE
      resources:
      - pods
  validations:
  - expression: |
      (has(object.spec.os) &&
       has(object.spec.os.name) &&
       object.spec.os.name.lowerAscii() == "windows") ||
      !has(object.spec.initContainers) || object.spec.initContainers.all(ic,
        has(ic.securityContext) &&
        has(ic.securityContext.allowPrivilegeEscalation) &&
        ic.securityContext.allowPrivilegeEscalation == false
      )
    message: |
      spec.initContainers[*].securityContext.allowPrivilegeEscalation must be set to false.

Save it as initcontainer-privilege-escalation.yaml — the commands below assume that name.

Validate with kubeapt

Check a workload against this one policy, before anything is installed on a cluster.

$ kubeapt validate -p ./initcontainer-privilege-escalation.yaml -r ./workload.yaml

Or without the file, from the published policy set — -r takes a directory too:

$ kubeapt policies download && kubeapt validate --policy-name initcontainer-privilege-escalation -r ./manifests

Or against every namespace in the cluster your kubeconfig points at:

$ kubeapt validate --policy-name initcontainer-privilege-escalation -A

Bundles

Source

View policy.yaml on GitHub →