Files
opendesk/docs/security/sec-ctx/sec-ctx-010_privilege-escalation.yaml
2025-12-01 13:33:13 +01:00

42 lines
1.5 KiB
YAML

# Source: https://github.com/kyverno/policies/tree/main/pod-security
# License: Apache-2.0
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
labels:
opendesk.eu/security-id: sec-ctx-010
annotations:
kyverno.io/kyverno-version: 1.6.0
policies.kyverno.io/category: Pod Security Standards (Restricted)
policies.kyverno.io/description: Privilege escalation, such as via set-user-ID
or set-group-ID file mode, should not be allowed. This policy ensures the `allowPrivilegeEscalation`
field is set to `false`.
policies.kyverno.io/severity: medium
policies.kyverno.io/subject: Pod
policies.kyverno.io/title: Disallow Privilege Escalation
name: disallow-privilege-escalation
spec:
background: true
rules:
- match:
any:
- resources:
kinds:
- Pod
name: privilege-escalation
validate:
message: Privilege escalation is disallowed. The fields spec.containers[*].securityContext.allowPrivilegeEscalation,
spec.initContainers[*].securityContext.allowPrivilegeEscalation, and spec.ephemeralContainers[*].securityContext.allowPrivilegeEscalation
must be set to `false`.
pattern:
spec:
=(ephemeralContainers):
- securityContext:
allowPrivilegeEscalation: "false"
=(initContainers):
- securityContext:
allowPrivilegeEscalation: "false"
containers:
- securityContext:
allowPrivilegeEscalation: "false"
validationFailureAction: Audit