C-0198 - Minimize the admission of root containers

Framework

cis-v1.23-t1.0.1

Severity

Medium

Description of the the issue

Containers may run as any Linux user. Containers which run as the root user, whilst constrained by Container Runtime security features still have a escalated likelihood of container breakout.

Ideally, all containers should run as a defined non-UID 0 user.

There should be at least one admission control policy defined which does not permit root containers.

If you need to run root containers, this should be defined in a separate policy and you should carefully check to ensure that only limited service accounts and users are given permission to use that policy.

Related resources

MutatingWebhookConfiguration, Namespace, ValidatingWebhookConfiguration

What does this control test

Do not generally permit containers to be run as the root user.

How to check it manually

List the policies in use for each namespace in the cluster, ensure that each policy restricts the use of root containers by setting MustRunAsNonRoot or MustRunAs with the range of UIDs not including 0.

Remediation

Create a policy for each namespace in the cluster, ensuring that either MustRunAsNonRoot or MustRunAs with the range of UIDs not including 0, is set.

Impact Statement

Pods with containers which run as the root user will not be permitted.

Default Value

By default, there are no restrictions on the use of root containers and if a User is not specified in the image, the container will run as root.

Example

No example