Skip to content

Conversation

juev
Copy link
Contributor

@juev juev commented Aug 8, 2025

  • Introduced NoNewPrivilegesRule to ensure containers do not allow privilege escalation.
  • Added SeccompProfileRule to validate seccomp profiles for containers, ensuring proper security configurations.
  • Updated linters settings to include new exclusion rules for NoNewPrivileges and SeccompProfile.

Example:

🐒 [no-new-privileges (#container)]
     Message:      Container's SecurityContext is missing - cannot verify allowPrivilegeEscalation setting
     Module:       kube-dns
     Object:       kind = Deployment ; name = d8-kube-dns-sts-pods-hosts-appender-webhook ; namespace = kube-system ; container = webhook
     FilePath:     templates/sts-pods-hosts-appender-webhook/deployment.yaml

🐒 [seccomp-profile (#container)]
     Message:      No seccomp profile specified - consider explicitly setting seccompProfile.type to 'RuntimeDefault'
                   for better security posture
     Module:       kube-dns
     Object:       kind = Deployment ; name = d8-kube-dns-sts-pods-hosts-appender-webhook ; namespace = kube-system ; container = webhook
     FilePath:     templates/sts-pods-hosts-appender-webhook/deployment.yaml

…pProfile

- Introduced NoNewPrivilegesRule to ensure containers do not allow privilege escalation.
- Added SeccompProfileRule to validate seccomp profiles for containers, ensuring proper security configurations.
- Updated linters settings to include new exclusion rules for NoNewPrivileges and SeccompProfile.
- Enhanced documentation in README.md to reflect new checks and their implications.
@juev juev requested a review from ldmonster August 8, 2025 11:52
@juev juev self-assigned this Aug 8, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant