Policy allows all capabilities Affecting Pod Security Policy service in Kubernetes
Severity Framework
Snyk CCSS
Rule category
Containers / Best Practices
Is your enviroment affected by this misconfiguration?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsFrameworks
CIS-Controls
CSA-CCM
- Snyk ID SNYK-CC-00636
- credit Snyk Research Team
Description
The whitelist of allowed capability is set to all.
How to fix?
Remove allowedCapabilities attribute, or set value to [].
Example Configuration
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: demo
spec:
seLinux:
rule: RunAsAny
supplementalGroups:
rule: RunAsAny
runAsUser:
rule: RunAsAny
fsGroup:
rule: RunAsAny
requiredDropCapabilities:
- ALL
allowedCapabilities:
- []