Privilege escalation allowed 이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우
언제든지 연락주시기 바랍니다. Id: kubernetes-privilege-escalation-allowed
Platform: Kubernetes
Severity: High
Category: Insecure Configurations
Learn More Description Containers should not run with the allowPrivilegeEscalation attribute set to true. The attribute must be present and set to false to prevent a container from gaining more privileges than its parent process. This rule applies to both containers and initContainers and reports missing attributes or values set to true.
Compliant Code Examples apiVersion : v1
kind : Pod
metadata :
name : pod1
spec :
containers :
- name : app
image : images.my-company.example/app:v4
securityContext :
allowPrivilegeEscalation : false
resources :
requests :
memory : "64Mi"
cpu : "250m"
limits :
memory : "128Mi"
cpu : "500m"
- name : log-aggregator
image : images.my-company.example/log-aggregator:v6
securityContext :
allowPrivilegeEscalation : false
resources :
requests :
memory : "64Mi"
cpu : "250m"
limits :
memory : "128Mi"
cpu : "500m"
Non-Compliant Code Examples apiVersion : v1
kind : Pod
metadata :
name : pod2
spec :
containers :
- name : app
image : images.my-company.example/app:v4
securityContext :
allowPrivilegeEscalation : true
resources :
requests :
memory : "64Mi"
cpu : "250m"
limits :
memory : "128Mi"
cpu : "500m"
- name : log-aggregator
image : images.my-company.example/log-aggregator:v6
securityContext :
runAsUser : 2000
resources :
requests :
memory : "64Mi"
cpu : "250m"
limits :
memory : "128Mi"
cpu : "500m"
apiVersion : v1
kind : Pod
metadata :
name : example-priv
spec :
containers :
- name : payment
image : nginx
securityContext :
capabilities :
drop :
- SYS_ADMIN
- name : payment2
image : nginx
- name : payment4
image : nginx
securityContext :
capabilities :
add :
- NET_BIND_SERVICE
- name : payment3
image : nginx
securityContext :
allowPrivilegeEscalation : false
