Drop Container Capabilities
An XCCDF Rule
Description
Containers should not enable more capabilities than needed as this
opens the door for malicious use. To disable the
capabilities, the appropriate Security Context Constraints (SCCs)
should set all capabilities as * or a list of capabilities in
requiredDropCapabilities.
Rationale
By default, containers run with a default set of capabilities as assigned by the Container Runtime which can include dangerous or highly privileged capabilities. Capabilities should be dropped unless absolutely critical for the container to run software as added capabilities that are not required allow for malicious containers or attackers.
- ID
- xccdf_org.ssgproject.content_rule_scc_drop_container_capabilities
- Severity
- Medium
- References
- Updated