Limit Containers Ability to Escalate Privileges
An XCCDF Rule
Description
Containers should be limited to only the privileges required
to run and should not be allowed to escalate their privileges.
To prevent containers from escalating privileges,
the appropriate Security Context Constraints (SCCs)
should set allowPrivilegeEscalation to false.
Rationale
Privileged containers have access to more of the Linux Kernel capabilities and devices. If a privileged container were compromised, an attacker would have full access to the container and host.
- ID
- xccdf_org.ssgproject.content_rule_scc_limit_privilege_escalation
- Severity
- Medium
- References
- Updated