You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+1-1
Original file line number
Diff line number
Diff line change
@@ -38,7 +38,7 @@ For a full list of checks, see [README_CHECKS.md](README_CHECKS.md).
38
38
* Deployments and StatefulSets should have a `PodDisruptionPolicy`
39
39
* Deployments and StatefulSets should have host PodAntiAffinity configured
40
40
* Container probes, a readiness should be configured, and should not be identical to the liveness probe. Read more in [README_PROBES.md](README_PROBES.md).
41
-
* Container securityContext, run as high number user/group, do not run as root or with privileged root fs
41
+
* Container securityContext, run as high number user/group, do not run as root or with privileged root fs. Read more in [README_SECURITYCONTEXT.md](README_SECURITYCONTEXT.md).
42
42
* Stable APIs, use a stable API if available (supported: Deployments, StatefulSets, DaemonSet)
Copy file name to clipboardExpand all lines: README_CHECKS.md
+4-1
Original file line number
Diff line number
Diff line change
@@ -14,7 +14,10 @@
14
14
| pod-networkpolicy | Pod | Makes sure that all Pods are targeted by a NetworkPolicy | default |
15
15
| networkpolicy-targets-pod | NetworkPolicy | Makes sure that all NetworkPolicies targets at least one Pod | default |
16
16
| pod-probes | Pod | Makes sure that all Pods have safe probe configurations | default |
17
-
| container-security-context | Pod | Makes sure that all pods have good securityContexts configured | default |
17
+
| container-security-context | Pod | Makes sure that all pods have good securityContexts configured (*deprecated*, see [README_SECURITYCONTEXT.md](README_SECURITYCONTEXT.md)| default |
18
+
| container-security-context-user-group-id | Pod | Makes sure that user and group ID are set and > 10000 | optional |
19
+
| container-security-context-privileged | Pod | Makes sure that no Containers run in privileged mode | optional |
20
+
| container-security-context-readonlyrootfilesystem | Makes sure that all Containers have read only filesystems | optional |
18
21
| container-seccomp-profile | Pod | Makes sure that all pods have at a seccomp policy configured. | optional |
19
22
| service-targets-pod | Service | Makes sure that all Services targets a Pod | default |
20
23
| service-type | Service | Makes sure that the Service type is not NodePort | default |
Copy file name to clipboardExpand all lines: score/security/security.go
+100
Original file line number
Diff line number
Diff line change
@@ -10,10 +10,110 @@ import (
10
10
11
11
funcRegister(allChecks*checks.Checks) {
12
12
allChecks.RegisterPodCheck("Container Security Context", `Makes sure that all pods have good securityContexts configured`, containerSecurityContext)
13
+
14
+
allChecks.RegisterOptionalPodCheck("Container Security Context User Group ID", `Makes sure that all pods have a security context with valid UID and GID set `, containerSecurityContextUserGroupID)
15
+
allChecks.RegisterOptionalPodCheck("Container Security Context Privileged", "Makes sure that all pods have a unprivileged security context set", containerSecurityContextPrivileged)
16
+
allChecks.RegisterOptionalPodCheck("Container Security Context ReadOnlyRootFilesystem", "Makes sure that all pods have a security context with read only filesystem set", containerSecurityContextReadOnlyRootFilesystem)
17
+
13
18
allChecks.RegisterOptionalPodCheck("Container Seccomp Profile", `Makes sure that all pods have at a seccomp policy configured.`, podSeccompProfile)
14
19
}
15
20
21
+
// containerSecurityContextReadOnlyRootFilesystem checks for pods using writeable root filesystems
score.AddComment(container.Name, "The container is privileged", "Set securityContext.privileged to false. Privileged containers can access all devices on the host, and grants almost the same access as non-containerized processes on the host.")
60
+
}
61
+
}
62
+
ifhasPrivileged {
63
+
score.Grade=scorecard.GradeCritical
64
+
} else {
65
+
score.Grade=scorecard.GradeAllOK
66
+
}
67
+
return
68
+
}
69
+
70
+
// containerSecurityContextUserGroupID checks that the user and group are valid ( > 10000) in the security context
score.AddComment(container.Name, "Container has no configured security context", "Set securityContext to run the container in a more secure context.")
82
+
continue
83
+
}
84
+
sec:=container.SecurityContext
85
+
ifsec==nil {
86
+
sec=&corev1.SecurityContext{}
87
+
}
88
+
// Forward values from PodSecurityContext to the (container level) SecurityContext if not set
89
+
ifpodSecurityContext!=nil {
90
+
ifsec.RunAsGroup==nil {
91
+
sec.RunAsGroup=podSecurityContext.RunAsGroup
92
+
}
93
+
ifsec.RunAsUser==nil {
94
+
sec.RunAsUser=podSecurityContext.RunAsUser
95
+
}
96
+
}
97
+
ifsec.RunAsUser==nil||*sec.RunAsUser<10000 {
98
+
hasLowUserID=true
99
+
score.AddComment(container.Name, "The container is running with a low user ID", "A userid above 10 000 is recommended to avoid conflicts with the host. Set securityContext.runAsUser to a value > 10000")
100
+
}
101
+
102
+
ifsec.RunAsGroup==nil||*sec.RunAsGroup<10000 {
103
+
hasLowGroupID=true
104
+
score.AddComment(container.Name, "The container running with a low group ID", "A groupid above 10 000 is recommended to avoid conflicts with the host. Set securityContext.runAsGroup to a value > 10000")
105
+
}
106
+
}
107
+
ifnoContextSet||hasLowUserID||hasLowGroupID {
108
+
score.Grade=scorecard.GradeCritical
109
+
} else {
110
+
score.Grade=scorecard.GradeAllOK
111
+
}
112
+
return
113
+
}
114
+
16
115
// containerSecurityContext checks that the recommended securityPolicy options are set
116
+
// Deprecated: will be replaced with "Container Security Context User Group ID", "Container Security Context Privileged" and "Container Security Context ReadOnlyRootFilesystem" in future versions
Description: "Set securityContext.privileged to false. Privileged containers can access all devices on the host, and grants almost the same access as non-containerized processes on the host.",
0 commit comments