Container Is Privileged

YAML Configuration

rule.yaml YAML

apiVersion: rules.spotter.dev/v1alpha1
kind: SpotterRule
metadata:
  name: spotter-workload-001
  labels:
    severity: "critical"
    category: "workload"
  annotations:
    rules.spotter.dev/title: "Container Is Privileged"
    rules.spotter.dev/version: "1.0.0"
    rules.spotter.dev/cwe: "CWE-269"
    rules.spotter.dev/description: "Containers should not run in privileged mode, as this grants all capabilities to the container and removes all security restrictions."
spec:
  match:
    resources:
      kubernetes:
        apiGroups: ["", "apps"]
        versions: ["v1"]
        kinds: ["Pod", "Deployment", "StatefulSet", "DaemonSet"]
        namespaces:
          include: ["*"]
          exclude: ["kube-system", "kube-public"]
        labels:
          exclude: 
            rules.spotter.dev/ignore: ["true"]
  cel: |
    (object.kind == 'Pod' && (
      (has(object.spec.containers) && object.spec.containers.exists(c, has(c.securityContext) && has(c.securityContext.privileged) && c.securityContext.privileged == true)) ||
      (has(object.spec.initContainers) && object.spec.initContainers.exists(c, has(c.securityContext) && has(c.securityContext.privileged) && c.securityContext.privileged == true))
    )) || (object.kind != 'Pod' && (
      (has(object.spec.template.spec.containers) && object.spec.template.spec.containers.exists(c, has(c.securityContext) && has(c.securityContext.privileged) && c.securityContext.privileged == true)) ||
      (has(object.spec.template.spec.initContainers) && object.spec.template.spec.initContainers.exists(c, has(c.securityContext) && has(c.securityContext.privileged) && c.securityContext.privileged == true))
    ))
  remediation:
    manual: "Set `privileged: false` in the container's security context."
  references:
    - title: "Kubernetes Pod Security Standards (Restricted)"
      url: "https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted"

Test Cases

test-cases.yaml YAML

- name: insecure sample 1 should fail
  pass: false
  input: |
    apiVersion: v1
    kind: Pod
    metadata:
      name: security-context-demo-4
    spec:
      containers:
      - name: sec-ctx-4
        image: gcr.io/google-samples/node-hello:1.0
        securityContext:
          privileged: true
          capabilities:
            add: ["NET_ADMIN", "SYS_TIME"]

- name: insecure sample 2 should fail
  pass: false
  input: |
    apiVersion: v1
    kind: Pod
    metadata:
      name: security-context-demo-5
    spec:
      initContainers:
      - name: sec-ctx-4
        image: gcr.io/google-samples/node-hello:1.0
        securityContext:
          privileged: true
          capabilities:
            add: ["NET_ADMIN", "SYS_TIME"]
      containers:
      - name: sec-ctx-4
        image: gcr.io/google-samples/node-hello:1.0

- name: insecure sample 3 should fail
  pass: false
  input: |
    apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: test-deployment
      labels:
        app: test
    spec:
      replicas: 3
      selector:
        matchLabels:
          app: test
      template:
        metadata:
          labels:
            app: test
        spec:
          containers:
            - name:  pause
              image: k8s.gcr.io/pause
              securityContext:
                privileged: true


- name: secure sample 1 should pass
  pass: true
  input: |
    apiVersion: v1
    kind: Pod
    metadata:
      name: security-context-demo-4
    spec:
      containers:
      - name: sec-ctx-4
        image: gcr.io/google-samples/node-hello:1.0
        securityContext:
          privileged: false
          capabilities:
            add: ["NET_ADMIN", "SYS_TIME"]

Validating Admission Policy

validating-admission-policy.yaml YAML

# VAP export for spotter-workload-001
# Generated from Spotter rule
apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingAdmissionPolicy
metadata:
  name: spotter-workload-001
spec:
  # Add your VAP configuration here

Rule Metadata

Container Is Privileged

YAML Configuration

Test Cases

Validating Admission Policy

Rule Metadata

Rule Information

Tags & Compliance

Compliance Standards

General Tags

Spotter Hub