ben.carrasco/prowler
1
0 Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-10-26 13:24:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(kubernetes): validate seccomp profile at pod and container levels (#5828)

Browse Source 
Co-authored-by: Sergio Garcia <hello@mistercloudsec.com>
This commit is contained in:
Prowler BotandSergio Garcia authored and GitHub committed 2024-11-19 10:58:27 -04:00
1 parent 94bc429bda
commit 0a97ee544a
1 file changed
+26 -6
Download Patch File Download Diff File Expand all files Collapse all files
prowler/providers/kubernetes/services/core/core_seccomp_profile_docker_default/core_seccomp_profile_docker_default.py
+26 -6
View File
@@ -10,18 +10,38 @@ class core_seccomp_profile_docker_default(Check):
report.namespace = pod.namespace
report.resource_name = pod.name
report.resource_id = pod.uid
if (
pod_seccomp_correct = (
pod.security_context
and pod.security_context.seccomp_profile
and pod.security_context.seccomp_profile.type == "RuntimeDefault"
):
)
containers_seccomp_correct = True
# Check container-level seccomp profile
for container in pod.containers.values():
if not (
container.security_context
and container.security_context.seccomp_profile
and container.security_context.seccomp_profile.type
== "RuntimeDefault"
):
containers_seccomp_correct = False
break
# Determine the report status
if pod_seccomp_correct or containers_seccomp_correct:
report.status = "PASS"
report.status_extended = (
f"Pod {pod.name} has docker/default seccomp profile enabled."
)
report.status_extended = f"Pod {pod.name} and its containers have docker/default seccomp profile enabled."
else:
report.status = "FAIL"
report.status_extended = f"Pod {pod.name} does not have docker/default seccomp profile enabled."
if not pod_seccomp_correct and not containers_seccomp_correct:
report.status_extended = f"Pod {pod.name} does not have docker/default seccomp profile enabled at both pod and container levels."
elif not pod_seccomp_correct:
report.status_extended = f"Pod {pod.name} does not have docker/default seccomp profile enabled at pod level."
else:
report.status_extended = f"Pod {pod.name} does not have docker/default seccomp profile enabled at container level."
findings.append(report)
return findings