Privileged containers are admitted

Description

Privileged containers are containers that have all of the root capabilities of a host machine, allowing access to resources that are not accessible in ordinary containers. Running a container with a privileged flag allows users to have critical access to the host's resources. If a privileged container is compromised, it does not necessarily entail remote code execution, but it implies that an attacker will be able to run full host root with all of the available capabilities, including CAP_SYS_ADMIN. Common uses of privileged containers include: running a Docker daemon inside a Docker container, running a container with direct hardware access, and automating CI/CD tasks in the open-source automation server Jenkins.

Code Example

apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: <policy name>
spec:
+ privileged: false

Remediation

Kubernetes

• Resource: PodSecurityPolicy
• Arguments: privileged (Optional) When set to false, containers are unable to run processes that are essentially equivalent to root on the host.

Rule Details

Field	Value
ID	IAC-1080
Severity	HIGH
IaC Type	Kubernetes
Frameworks	Kubernetes,
Checkov ID	CKV_K8S_2

References

• Checkov Rule

---