From 0a97ee544a7f13dd253af29b8f8b137019ad8300 Mon Sep 17 00:00:00 2001 From: Prowler Bot Date: Tue, 19 Nov 2024 15:58:27 +0100 Subject: [PATCH] fix(kubernetes): validate seccomp profile at pod and container levels (#5828) Co-authored-by: Sergio Garcia --- .../core_seccomp_profile_docker_default.py | 32 +++++++++++++++---- 1 file changed, 26 insertions(+), 6 deletions(-) diff --git a/prowler/providers/kubernetes/services/core/core_seccomp_profile_docker_default/core_seccomp_profile_docker_default.py b/prowler/providers/kubernetes/services/core/core_seccomp_profile_docker_default/core_seccomp_profile_docker_default.py index 71c4a7f28a..20a9c16b2f 100644 --- a/prowler/providers/kubernetes/services/core/core_seccomp_profile_docker_default/core_seccomp_profile_docker_default.py +++ b/prowler/providers/kubernetes/services/core/core_seccomp_profile_docker_default/core_seccomp_profile_docker_default.py @@ -10,18 +10,38 @@ class core_seccomp_profile_docker_default(Check): report.namespace = pod.namespace report.resource_name = pod.name report.resource_id = pod.uid - if ( + + pod_seccomp_correct = ( pod.security_context and pod.security_context.seccomp_profile and pod.security_context.seccomp_profile.type == "RuntimeDefault" - ): + ) + containers_seccomp_correct = True + + # Check container-level seccomp profile + for container in pod.containers.values(): + if not ( + container.security_context + and container.security_context.seccomp_profile + and container.security_context.seccomp_profile.type + == "RuntimeDefault" + ): + containers_seccomp_correct = False + break + + # Determine the report status + if pod_seccomp_correct or containers_seccomp_correct: report.status = "PASS" - report.status_extended = ( - f"Pod {pod.name} has docker/default seccomp profile enabled." - ) + report.status_extended = f"Pod {pod.name} and its containers have docker/default seccomp profile enabled." else: report.status = "FAIL" - report.status_extended = f"Pod {pod.name} does not have docker/default seccomp profile enabled." + if not pod_seccomp_correct and not containers_seccomp_correct: + report.status_extended = f"Pod {pod.name} does not have docker/default seccomp profile enabled at both pod and container levels." + elif not pod_seccomp_correct: + report.status_extended = f"Pod {pod.name} does not have docker/default seccomp profile enabled at pod level." + else: + report.status_extended = f"Pod {pod.name} does not have docker/default seccomp profile enabled at container level." + findings.append(report) return findings