mirror of
https://github.com/aquasecurity/kube-hunter.git
synced 2026-08-21 05:06:32 +00:00
23 lines
836 B
Markdown
23 lines
836 B
Markdown
---
|
|
vid: KHV044
|
|
title: Privileged Container
|
|
categories: [Access Risk]
|
|
---
|
|
|
|
# {{ page.vid }} - {{ page.title }}
|
|
|
|
## Issue description
|
|
|
|
A privileged container is given access to all devices on the host and can work at the kernel level. It is declared using the `Pod.spec.containers[].securityContext.privileged` attribute. This may be useful for infrastructure containers that perform setup work on the host, but is a dangerous attack vector.
|
|
|
|
## Remediation
|
|
|
|
Minimize the use of privileged containers.
|
|
|
|
Use Pod Security Policies to enforce using `privileged: false` policy.
|
|
|
|
## References
|
|
|
|
- [Privileged mode for pod containers](https://kubernetes.io/docs/concepts/workloads/pods/pod/#privileged-mode-for-pod-containers)
|
|
- [Pod Security Policies - Privileged](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privileged)
|