hacktricks/pentesting/pentesting-kubernetes/kubernetes-hardening/kubernetes-securitycontext-s.md

# Kubernetes SecurityContext(s)

## PodSecurityContext <a href="#podsecuritycontext-v1-core" id="podsecuritycontext-v1-core"></a>

When specifying the security context of a Pod you can use several attributes. From a defensive security point of view you should consider:

* To have **runASNonRoot** as **True**
* To configure **runAsUser**
* If possible, consider **limiting** **permissions** indicating **seLinuxOptions** and **seccompProfile**
* Do **NOT** give  **privilege** **group** access via **fsGroup**, **runAsGroup** and **supplementaryGroups**

| <p><strong></strong><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core"><strong>fsGroup</strong></a><br><em>integer</em></p>                                                                                                                                                                                                                                                                                                            | This allows to specify a **supplementary groups to all processes of the containers**. Usually used to give access to mounted volumes.                                                                        |
| --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| <p><strong></strong><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core"><strong>fsGroupChangePolicy</strong></a><br><em>string</em></p>                                                                                                                                                                                                                                                                                                 | This defines behavior of **changing ownership and permission of the volume** before being exposed inside Pod.                                                                                                |
| <p><strong></strong><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core"><strong>runAsGroup</strong></a><br><em>integer</em></p>                                                                                                                                                                                                                                                                                                         | The **GID to run the entrypoint of the container process**. Uses runtime default if unset. May also be set in SecurityContext.                                                                               |
| <p><strong></strong><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core"><strong>runAsNonRoot</strong></a><br><em>boolean</em></p>                                                                                                                                                                                                                                                                                                       | Indicates that the container must run as a non-root user. If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does. |
| <p><strong></strong><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core"><strong>runAsUser</strong></a><br><em>integer</em></p>                                                                                                                                                                                                                                                                                                          | The **UID to run the entrypoint of the container process**. Defaults to user specified in image metadata if unspecified.                                                                                     |
| <p><strong></strong><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core"><strong>seLinuxOptions</strong></a><br><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#selinuxoptions-v1-core"><em>SELinuxOptions</em></a><em></em><br><em>More info about</em> <a href="../../../linux-unix/privilege-escalation/selinux.md"><em><strong>seLinux</strong></em></a><em><strong></strong></em></p>                 | The **SELinux context to be applied to all containers**. If unspecified, the container runtime will allocate a random SELinux context for each container.                                                    |
| <p><strong></strong><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core"><strong>seccompProfile</strong></a><br><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#seccompprofile-v1-core"><em>SeccompProfile</em></a><em></em><br><em>More info about</em> <a href="../../../linux-unix/privilege-escalation/docker-breakout/seccomp.md"><em><strong>Seccomp</strong></em></a><em><strong></strong></em></p> | The **seccomp options to use by the containers** in this pod.                                                                                                                                                |
| <p><strong></strong><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core"><strong>supplementalGroups</strong></a><br><em>integer array</em></p>                                                                                                                                                                                                                                                                                           | A list of **groups applied to the first process run in each container**, in addition to the container's primary GID.                                                                                         |
| <p><strong></strong><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core"><strong>sysctls</strong></a><br><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#sysctl-v1-core"><em>Sysctl</em></a> <em>array</em><br><em>More info about</em> <a href="https://www.garron.me/en/go2linux/sysctl-linux.html"><em><strong>sysctls</strong></em></a><em><strong></strong></em></p>                                  | Sysctls hold a list of **namespaced sysctls used for the pod**. Pods with unsupported sysctls (by the container runtime) might fail to launch.                                                               |
| <p><strong></strong><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core"><strong>windowsOptions</strong></a><br><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#windowssecuritycontextoptions-v1-core"><em>WindowsSecurityContextOptions</em></a></p>                                                                                                                                                      | The Windows specific settings applied to all containers. If unspecified, the options within a container's SecurityContext will be used.                                                                      |

## SecurityContext

This context is set inside the **containers definitions**. From a defensive security point of view you should consider:

* **allowPrivilegeEscalation** to **False**
* Do not add sensitive **capabilities** (and remove the ones you don't need)
* **privileged** to **False**
* If possible, set **readOnlyFilesystem** as **True**
* Set **runAsNonRoot** to **True** and set a **runAsUser**
* If possible, consider **limiting** **permissions** indicating **seLinuxOptions** and **seccompProfile**
* Do **NOT** give  **privilege** **group** access via **runAsGroup.**

Note that the attributes set in **both SecurityContext and PodSecurityContext**, the value specified in **SecurityContext** takes **precedence**.

| <p><strong></strong><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core"><strong>allowPrivilegeEscalation</strong></a><br><em>boolean</em></p>                                                                                                                                                                                                                                                                                     | **AllowPrivilegeEscalation** controls whether a process can **gain more privileges** than its parent process. This bool directly controls if the no\_new\_privs flag will be set on the container process. AllowPrivilegeEscalation is true always when the container is run as **Privileged** or has **CAP\_SYS\_ADMIN** |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| <p><strong></strong><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core"><strong>capabilities</strong></a><br><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#capabilities-v1-core"><em>Capabilities</em></a><em></em><br><em>More info about</em> <a href="../../../linux-unix/privilege-escalation/linux-capabilities.md"><em><strong>Capabilities</strong></em></a><em><strong></strong></em></p> | The **capabilities to add/drop when running containers**. Defaults to the default set of capabilities.                                                                                                                                                                                                                    |
| <p><strong></strong><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core"><strong>privileged</strong></a><br><em>boolean</em></p>                                                                                                                                                                                                                                                                                                   | Run container in privileged mode. Processes in privileged containers are essentially **equivalent to root on the host**. Defaults to false.                                                                                                                                                                               |
| <p><strong></strong><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core"><strong>procMount</strong></a><br><em>string</em></p>                                                                                                                                                                                                                                                                                                     | procMount denotes the **type of proc mount to use for the containers**. The default is DefaultProcMount which uses the container runtime defaults for readonly paths and masked paths.                                                                                                                                    |
| <p><strong></strong><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core"><strong>readOnlyRootFilesystem</strong></a><br><em>boolean</em></p>                                                                                                                                                                                                                                                                                       | Whether this **container has a read-only root filesystem**. Default is false.                                                                                                                                                                                                                                             |
| <p><strong></strong><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core"><strong>runAsGroup</strong></a><br><em>integer</em></p>                                                                                                                                                                                                                                                                                                   | The **GID to run the entrypoint** of the container process. Uses runtime default if unset.                                                                                                                                                                                                                                |
| <p><strong></strong><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core"><strong>runAsNonRoot</strong></a><br><em>boolean</em></p>                                                                                                                                                                                                                                                                                                 | Indicates that the container must **run as a non-root user**. If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does.                                                                                                          |
| <p><strong></strong><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core"><strong>runAsUser</strong></a><br><em>integer</em></p>                                                                                                                                                                                                                                                                                                    | The **UID to run the entrypoint** of the container process. Defaults to user specified in image metadata if unspecified.                                                                                                                                                                                                  |
| <p><strong></strong><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core"><strong>seLinuxOptions</strong></a><br><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#selinuxoptions-v1-core"><em>SELinuxOptions</em></a><em></em><br><em>More info about</em> <a href="../../../linux-unix/privilege-escalation/selinux.md"><em><strong>seLinux</strong></em></a><em><strong></strong></em></p>           | The **SELinux context to be applied to the container**. If unspecified, the container runtime will allocate a random SELinux context for each container.                                                                                                                                                                  |
| <p><strong></strong><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core"><strong>seccompProfile</strong></a><br><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#seccompprofile-v1-core"><em>SeccompProfile</em></a></p>                                                                                                                                                                              | The **seccomp options** to use by this container.                                                                                                                                                                                                                                                                         |
| <p><strong></strong><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core"><strong>windowsOptions</strong></a><br><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#windowssecuritycontextoptions-v1-core"><em>WindowsSecurityContextOptions</em></a></p>                                                                                                                                                | The **Windows specific settings** applied to all containers.                                                                                                                                                                                                                                                              |

## References

* [https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core)
* [https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core)