Policy sets insecure default seccomp profile Affecting Pod Security Policy service in Kubernetes
Severity Framework
Snyk CCSS
Rule category
Containers / Best Practices
Is your enviroment affected by this misconfiguration?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsFrameworks
CIS-Controls
CIS-Kubernetes
- Snyk ID SNYK-CC-00640
- credit Snyk Research Team
Description
Default seccomp profile is set to unconfined
. Containers will run with seccomp disabled.
How to fix?
Set seccomp.security.alpha.kubernetes.io/defaultProfileName
annotation to runtime/default
.