Limit Containers Ability to use the HostDir volume plugin
An XCCDF Rule
Description
Containers should be allowed to use the hostPath volume type unless
necessary. To prevent containers from using the host filesystem
the appropriate Security Context Constraints (SCCs) should set
allowHostDirVolumePlugin to false.
Rationale
hostPath volumes allow workloads to access the host filesystem
from the workload. Access to the host filesystem can be used to
escalate privileges and access resources such as keys or access
tokens.
- ID
- xccdf_org.ssgproject.content_rule_scc_limit_host_dir_volume_plugin
- Severity
- Medium
- References
- Updated