Limit Access to the Host Network Namespace
An XCCDF Rule
Description
Containers should not be allowed access to the host's network
namespace. To prevent containers from getting access to a host's
network namespace, the appropriate Security Context Constraints (SCCs)
should set allowHostNetwork to false.
Rationale
A container running in the host's network namespace could access the host network traffic to and from other pods potentially allowing an attacker to exploit pods and network traffic.
- ID
- xccdf_org.ssgproject.content_rule_scc_limit_network_namespace
- Severity
- Medium
- References
- Updated