From eb7f56f512278f1d12948bb13beb8a9f09f4c6a4 Mon Sep 17 00:00:00 2001 From: Sergio Garcia <38561120+sergargar@users.noreply.github.com> Date: Thu, 23 May 2024 10:37:57 -0400 Subject: [PATCH] fix(kubernetes): solve TypeError in Core NetRaw check (#4075) --- .../core_minimize_net_raw_capability_admission.py | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/prowler/providers/kubernetes/services/core/core_minimize_net_raw_capability_admission/core_minimize_net_raw_capability_admission.py b/prowler/providers/kubernetes/services/core/core_minimize_net_raw_capability_admission/core_minimize_net_raw_capability_admission.py index 1de252da5f..2cf0f11e42 100644 --- a/prowler/providers/kubernetes/services/core/core_minimize_net_raw_capability_admission/core_minimize_net_raw_capability_admission.py +++ b/prowler/providers/kubernetes/services/core/core_minimize_net_raw_capability_admission/core_minimize_net_raw_capability_admission.py @@ -13,12 +13,15 @@ class core_minimize_net_raw_capability_admission(Check): report.status = "PASS" report.status_extended = f"Pod {pod.name} does not have NET_RAW capability." for container in pod.containers.values(): - if "NET_RAW" in getattr( - getattr(container.security_context, "capabilities", None), "add", [] - ): - report.status = "FAIL" - report.status_extended = f"Pod {pod.name} has NET_RAW capability in container {container.name}." - break + security_context = getattr(container, "security_context", None) + if security_context: + capabilities = getattr(security_context, "capabilities", None) + if capabilities: + add_capabilities = getattr(capabilities, "add", []) + if "NET_RAW" in add_capabilities: + report.status = "FAIL" + report.status_extended = f"Pod {pod.name} has NET_RAW capability in container {container.name}." + break findings.append(report)