NET_RAW capabilities disabled for PSP

This product is not supported for your selected Datadog site. ().

Metadata

Id: 9aa32890-ac1a-45ee-81ca-5164e2098556

Cloud Provider: Kubernetes

Platform: Terraform

Severity: Medium

Category: Insecure Configurations

Learn More

Description

spec.required_drop_capabilities on kubernetes_pod_security_policy resources must be set to ['ALL', 'NET_RAW']. If spec.required_drop_capabilities is not ['ALL', 'NET_RAW'], the rule reports an IncorrectValue issue for the kubernetes_pod_security_policy resource.

Compliant Code Examples

resource "kubernetes_pod_security_policy" "example" {
  metadata {
    name = "terraform-example"
  }
  spec {
    privileged                 = false
    allow_privilege_escalation = false

    volumes = [
      "configMap",
      "emptyDir",
      "projected",
      "secret",
      "downwardAPI",
      "persistentVolumeClaim",
    ]
    required_drop_capabilities = [
      "ALL"
    ]

    run_as_user {
      rule = "MustRunAsNonRoot"
    }

    se_linux {
      rule = "RunAsAny"
    }

    supplemental_groups {
      rule = "MustRunAs"
      range {
        min = 1
        max = 65535
      }
    }

    fs_group {
      rule = "MustRunAs"
      range {
        min = 1
        max = 65535
      }
    }

    read_only_root_filesystem = true
  }
}

Non-Compliant Code Examples

resource "kubernetes_pod_security_policy" "example" {
  metadata {
    name = "terraform-example"
  }
  spec {
    privileged                 = false
    allow_privilege_escalation = false

    volumes = [
      "configMap",
      "emptyDir",
      "projected",
      "secret",
      "downwardAPI",
      "persistentVolumeClaim",
    ]
    required_drop_capabilities = [
      "KILL",
      "SYS_TIME",
    ]

    run_as_user {
      rule = "MustRunAsNonRoot"
    }

    se_linux {
      rule = "RunAsAny"
    }

    supplemental_groups {
      rule = "MustRunAs"
      range {
        min = 1
        max = 65535
      }
    }

    fs_group {
      rule = "MustRunAs"
      range {
        min = 1
        max = 65535
      }
    }

    read_only_root_filesystem = true
  }
}