Limit Use of the CAP_NET_RAW
An XCCDF Rule
Description
Containers should not enable more capabilities than needed as this
opens the door for malicious use. CAP_NET_RAW enables a container
to launch a network attack on another container or cluster. To disable the
CAP_NET_RAW capability, the appropriate Security Context Constraints (SCCs)
should set NET_RAW in requiredDropCapabilities.
Rationale
By default, containers run with a default set of capabilities as assigned by the Container Runtime which can include dangerous or highly privileged capabilities. If the CAP_NET_RAW is enabled, it may be misused by malicious containers or attackers.
- ID
- xccdf_org.ssgproject.content_rule_scc_limit_net_raw_capability
- Severity
- Medium
- References
- Updated