47 lines
1.7 KiB
YAML
47 lines
1.7 KiB
YAML
id: k8s-host-network-namespace-shared
|
|
|
|
info:
|
|
name: Host Network Namespace Sharing
|
|
author: princechaddha
|
|
severity: high
|
|
description: Checks if containers in Kubernetes Pods are configured to share the host's network namespace, which can lead to security risks.
|
|
impact: |
|
|
Sharing the host's network namespace allows containers to access the host network directly. This can lead to potential security breaches as containers might bypass network policies and gain unrestricted network access on the host.
|
|
remediation: |
|
|
Ensure that the 'hostNetwork' field is set to false in all Kubernetes Pods to prevent containers from sharing the host's network namespace.
|
|
reference:
|
|
- https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces
|
|
tags: cloud,devops,kubernetes,k8s,devsecops,namespace,k8s-cluster-security
|
|
|
|
flow: |
|
|
code(1);
|
|
for (let pod of template.items) {
|
|
set("pod", pod)
|
|
javascript(1);
|
|
}
|
|
|
|
self-contained: true
|
|
code:
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: kubectl get pods --all-namespaces --output=json
|
|
extractors:
|
|
- type: json
|
|
name: items
|
|
internal: true
|
|
json:
|
|
- '.items[]'
|
|
|
|
javascript:
|
|
- code: |
|
|
pod = JSON.parse(template.pod);
|
|
if (pod.spec.hostNetwork) {
|
|
let result = (`Pod '${pod.metadata.name}' in namespace '${pod.metadata.namespace}' is configured to share the host's network namespace.`);
|
|
Export(result);
|
|
}
|
|
extractors:
|
|
- type: dsl
|
|
dsl:
|
|
- response
|
|
# digest: 4a0a00473045022100d69f9d3352f6245cfa6f8e7d01fe74aa615f86848c9990dee3b7efed9888920e02202a7519d1ba3dc40214389af6146e1486832a051fba6fc79ae13ea45bece0f6ca:922c64590222798bb761d5b6d8e72950 |