Pod Without Seccomp Profile

YAML Configuration

rule.yaml YAML

apiVersion: rules.spotter.dev/v1alpha1
kind: SpotterRule
metadata:
  name: spotter-workload-012
  labels:
    severity: "critical"
    category: "workload"
  annotations:
    rules.spotter.dev/title: "Pod Without Seccomp Profile"
    rules.spotter.dev/version: "1.0.0"
    rules.spotter.dev/cwe: "CWE-024"
    rules.spotter.dev/description: "All pods must set Seccomp profile to RuntimeDefault or Localhost."
spec:
  match:
    resources:
      kubernetes:
        apiGroups:
        - ''
        - apps
        versions:
        - v1
        kinds:
        - Pod
        - Deployment
        - StatefulSet
        namespaces:
          include:
          - '*'
          exclude:
          - kube-system
          - kube-public
        labels:
          exclude:
            rules.spotter.dev/ignore: ["true"]
  cel: |
    object.kind in ["Pod", "Deployment", "StatefulSet"] &&
    (
      (object.kind == "Pod" &&
        // Check if pod has no secure seccomp configuration
        !(
          (has(object.metadata.annotations) && 'seccomp.security.alpha.kubernetes.io/defaultProfileName' in object.metadata.annotations && object.metadata.annotations['seccomp.security.alpha.kubernetes.io/defaultProfileName'] == 'runtime/default') ||
          (has(object.spec.securityContext) && has(object.spec.securityContext.seccompProfile) && object.spec.securityContext.seccompProfile.type == "RuntimeDefault")
        ) &&
        // And containers don't all have secure seccomp profiles
        (!has(object.spec.containers) || !object.spec.containers.all(c,
          has(c.securityContext) && has(c.securityContext.seccompProfile) && c.securityContext.seccompProfile.type == "RuntimeDefault"
        ))
      ) ||
      (object.kind in ["Deployment", "StatefulSet"] && has(object.spec.template) &&
        // Check if template has no secure seccomp configuration
        !(
          (has(object.spec.template.metadata.annotations) && 'seccomp.security.alpha.kubernetes.io/defaultProfileName' in object.spec.template.metadata.annotations && object.spec.template.metadata.annotations['seccomp.security.alpha.kubernetes.io/defaultProfileName'] == 'runtime/default') ||
          (has(object.spec.template.spec.securityContext) && has(object.spec.template.spec.securityContext.seccompProfile) && object.spec.template.spec.securityContext.seccompProfile.type == "RuntimeDefault")
        ) &&
        // And containers don't all have secure seccomp profiles
        (!has(object.spec.template.spec.containers) || !object.spec.template.spec.containers.all(c,
          has(c.securityContext) && has(c.securityContext.seccompProfile) && c.securityContext.seccompProfile.type == "RuntimeDefault"
        ))
      )
    )
  remediation:
    manual: "Set seccompProfile: RuntimeDefault"
  references:
    - title: "Kubernetes Seccomp"
      url: "https://kubernetes.io/docs/tutorials/security/seccomp/"

Test Cases

test-cases.yaml YAML

- name: insecure sample 1 should fail
  pass: false
  input: |
    apiVersion: v1
    kind: Pod
    metadata:
      name: pod-test-1
    spec:
      containers:
      - name: foobar
        image: foo/bar:latest

- name: insecure sample 2 should fail
  pass: false
  input: |
    apiVersion: v1
    kind: Pod
    metadata:
      name: pod-test-2
      annotations:
        some-annotation: myannotation
    spec:
      containers:
      - name: foobar
        image: foo/bar:latest
- name: insecure sample 3 should fail
  pass: false
  input: |
    apiVersion: v1
    kind: Pod
    metadata:
      name: pod-test-3
      annotations:
        seccomp.security.alpha.kubernetes.io/defaultProfileName: 'rntim/dfl'
    spec:
      containers:
      - name: foobar
        image: foo/bar:latest
- name: insecure sample 4 should fail
  pass: false
  input: |
    apiVersion: batch/v1beta1
    kind: CronJob
    metadata:
      name: hello
    spec:
      schedule: "*/1 * * * *"
      jobTemplate:
        spec:
          template:
            metadata:
              annotations:
                seccomp.security.alpha.kubernetes.io/defaultProfileName: 'rntim/dfl'
            spec:
              containers:
              - name: hello
                image: busybox
                imagePullPolicy: IfNotPresent
                args:
                - /bin/sh
                - -c
                - date; echo Hello from the Kubernetes cluster
              restartPolicy: OnFailure

- name: insecure sample 5 should fail
  pass: false
  input: |
    apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: securitydemo
      labels:
        app: web
    spec:
      replicas: 2
      selector:
        matchLabels:
          app: web
      template:
        metadata:
          labels:
            app: web
        spec:
          securityContext:
            runAsUser: 19000
          containers:
            - name: frontend
              image: nginx
              ports:
                - containerPort: 80
              securityContext:
                allowPrivilegeEscalation: false
            - name: echoserver
              image: k8s.gcr.io/echoserver:1.4
              ports:
                - containerPort: 8080
              securityContext:
                allowPrivilegeEscalation: false
                seccompProfile:
                    type: RuntimeDefault

- name: insecure sample 6 should fail
  pass: false
  input: |
    apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: securitydemo
      labels:
        app: web
    spec:
      replicas: 2
      selector:
        matchLabels:
          app: web
      template:
        metadata:
          labels:
            app: web
        spec:
          securityContext:
            runAsUser: 19000
          containers:
            - name: frontend
              image: nginx
              ports:
                - containerPort: 80
              securityContext:
                allowPrivilegeEscalation: false
            - name: echoserver
              image: k8s.gcr.io/echoserver:1.4
              ports:
                - containerPort: 8080
              securityContext:
                allowPrivilegeEscalation: false
                seccompProfile:
                    type: Unconfined

- name: insecure sample 7 should fail
  pass: false
  input: |
    apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: securitydemo
      labels:
        app: web
    spec:
      replicas: 2
      selector:
        matchLabels:
          app: web
      template:
        metadata:
          labels:
            app: web
        spec:
          securityContext:
            runAsUser: 19000
            seccompProfile:
                type: RuntimeDefault
          containers:
            - name: frontend
              image: nginx
              ports:
                - containerPort: 80
              securityContext:
                allowPrivilegeEscalation: false
            - name: echoserver
              image: k8s.gcr.io/echoserver:1.4
              ports:
                - containerPort: 8080
              securityContext:
                allowPrivilegeEscalation: false
                seccompProfile:
                    type: Unconfined

- name: secure sample 1 should pass
  pass: true
  input: |
    apiVersion: v1
    kind: Pod
    metadata:
      name: pod-test-1
      annotations:
        seccomp.security.alpha.kubernetes.io/defaultProfileName:  'runtime/default'
    spec:
      containers:
      - name: foobar
        image: foo/bar:latest

- name: secure sample 2 should pass
  pass: true
  input: |
    apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: securitydemo
      labels:
        app: web
    spec:
      replicas: 2
      selector:
        matchLabels:
          app: web
      template:
        metadata:
          labels:
            app: web
        spec:
          securityContext:
            runAsUser: 19000
            seccompProfile:
                type: RuntimeDefault
          containers:
            - name: frontend
              image: nginx
              ports:
                - containerPort: 80
              securityContext:
                allowPrivilegeEscalation: false
            - name: echoserver
              image: k8s.gcr.io/echoserver:1.4
              ports:
                - containerPort: 8080
              securityContext:
                allowPrivilegeEscalation: false

- name: secure sample 3 should pass
  pass: true
  input: |
    apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: securitydemo
      labels:
        app: web
    spec:
      replicas: 2
      selector:
        matchLabels:
          app: web
      template:
        metadata:
          labels:
            app: web
        spec:
          securityContext:
            runAsUser: 19000
          containers:
            - name: frontend
              image: nginx
              ports:
                - containerPort: 80
              securityContext:
                allowPrivilegeEscalation: false
                seccompProfile:
                    type: RuntimeDefault
            - name: echoserver
              image: k8s.gcr.io/echoserver:1.4
              ports:
                - containerPort: 8080
              securityContext:
                allowPrivilegeEscalation: false
                seccompProfile:
                    type: RuntimeDefault

Validating Admission Policy

validating-admission-policy.yaml YAML

# VAP export for spotter-workload-012
# Generated from Spotter rule
apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingAdmissionPolicy
metadata:
  name: spotter-workload-012
spec:
  # Add your VAP configuration here

Rule Metadata

Pod Without Seccomp Profile

YAML Configuration

Test Cases

Validating Admission Policy

Rule Metadata

Rule Information

Tags & Compliance

Compliance Standards

General Tags

Spotter Hub