Prevent Custom SE Linux Options 1.1.4

Prevent setting custom SELinux options.


Note that this policy is part of the following security standards:

  • k8s/baseline: Minimally restrictive policy while preventing known privilege escalations.
  • k8s/restricted: Heavily restricted policy, following current Pod hardening best practices.
  • nist/SP.800-190: NIST Special Publication 800-190 - Application Container Security Guide: Section 3.4.3
  • bsi/containerization: BSI IT-Grundschutz "Containerisierung": Section: SYS.1.6.A17
  • Host Access
  • Security
  • bsi/containerization
  • k8s/baseline
  • k8s/restricted
  • nist/SP.800-190

Applies to

  • Pod
  • ReplicaSet
  • ReplicationController
  • Deployment
  • StatefulSet
  • DaemonSet
  • Job
  • CronJob

Example

apiVersion: v1
kind: Pod
metadata:
  name: sysctl-example
spec:
  securityContext:
    seLinuxOptions:
-     type: spc_t
  containers:
  - name: hello
    image: dummy-cronjob:invalid
    securityContext:
      seLinuxOptions:
        type: container_t
  - name: nginx
    image: nginx:1.14.2
    securityContext:
      seLinuxOptions:
-       type: MustRunAs

Risk acceptance

Use the annotation securitytower.io/policy.exclusion.preventcustomselinuxoptions as on the example below.
apiVersion: v1
kind: Pod
metadata:
  name: your-pod
  annotations:
    securitytower.io/policy.exclusion.preventcustomselinuxoptions: |-
      This container must use custom SELinux options.
...