mirror of
https://github.com/projectdiscovery/nuclei-templates.git
synced 2026-01-31 15:53:33 +08:00
53 lines
2.0 KiB
YAML
53 lines
2.0 KiB
YAML
id: k8s-seccomp-profile-set
|
|
|
|
info:
|
|
name: Set appropriate seccomp profile
|
|
author: princechaddha
|
|
severity: medium
|
|
description: Checks if the seccomp profile is set to docker/default or runtime/default in Kubernetes Deployments.
|
|
impact: |
|
|
Using a default seccomp profile helps in reducing the attack surface of the container by limiting the syscalls containers can make, which can prevent certain types of exploits.
|
|
remediation: |
|
|
Ensure that all containers in Kubernetes Deployments have a seccomp profile of docker/default or runtime/default set in their security contexts.
|
|
reference:
|
|
- https://kubernetes.io/docs/tutorials/clusters/seccomp/
|
|
tags: cloud,devops,kubernetes,security,devsecops,containers
|
|
|
|
flow: |
|
|
code(1);
|
|
for (let deployment of template.items) {
|
|
set("deployment", deployment)
|
|
javascript(1);
|
|
}
|
|
|
|
self-contained: true
|
|
code:
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: kubectl get deployments --all-namespaces --output=json
|
|
extractors:
|
|
- type: json
|
|
name: items
|
|
internal: true
|
|
json:
|
|
- '.items[]'
|
|
|
|
javascript:
|
|
- code: |
|
|
deployment = JSON.parse(template.deployment);
|
|
deployment.spec.template.spec.containers.forEach(container => {
|
|
if (container.securityContext && container.securityContext.seccompProfile &&
|
|
(container.securityContext.seccompProfile.type === 'RuntimeDefault' || container.securityContext.seccompProfile.type === 'DockerDefault')) {
|
|
// No action needed, configured properly
|
|
} else {
|
|
let result = (`Deployment '${deployment.metadata.name}' in namespace '${deployment.metadata.namespace}' does not have an appropriate seccomp profile set.`);
|
|
Export(result);
|
|
}
|
|
});
|
|
|
|
extractors:
|
|
- type: dsl
|
|
dsl:
|
|
- response
|
|
# digest: 4a0a004730450221008b59741a5c3cbb00fea807cbfad091c4bbd5b4cfb68d0eaba6cbad0f5b41b031022021a3ff36185afd480db929ad18207f2b03a2a823ec1d1858de0facf7fd7b2bbf:366f2a24c8eb519f6968bd8801c08ebe |