Ensure Linux Kernel Capabilities Are Restricted (CIS 5.4)

Impact & Risk Analysis

Severity: Medium
CIS Benchmark: CIS 5.4
Impact: Network Spoofing & Privilege Escalation. By default, Docker containers retain capabilities like NET_RAW, which allows an attacker to create spoofed network traffic. If a container is compromised, having unnecessary kernel capabilities (like SYS_CHROOT or DAC_OVERRIDE) allows the attacker to bypass file permissions or escape the container isolation.

Common Misconfiguration

Running containers with the default Docker capability set, or worse, using --cap-add=ALL. The default set includes capabilities like NET_RAW which are often not required for standard web applications but pose a security risk.

Vulnerable Example

# Vulnerable docker-compose.yml
version: '3.8'
services:
  web:
    image: nginx:latest
    ports:
      - "80:80"
    # VULNERABLE: No capabilities are dropped.
    # The container implicitly has NET_RAW, AUDIT_WRITE, SETUID, etc.

# Vulnerable Docker Run Command
# Implicitly grants default capabilities including NET_RAW
docker run -d nginx:latest

Secure Example

# Secure docker-compose.yml
version: '3.8'
services:
  web:
    image: nginx:latest
    ports:
      - "80:80"
    # SECURE: Drop ALL capabilities first, then add only what is strictly needed.
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE  # Required to bind to port 80
      - CHOWN             # Required if Nginx needs to change file ownership

# Secure Docker Run Command
# Drops all capabilities and adds only NET_BIND_SERVICE
docker run -d --cap-drop=all --cap-add=NET_BIND_SERVICE nginx:latest

Audit Procedure

Run the following command to inspect the capabilities of running containers:

docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: CapAdd={{ .HostConfig.CapAdd }} CapDrop={{ .HostConfig.CapDrop }}'

Result: Review the output for each container.
Fail: If NET_RAW is not in CapDrop (unless explicitly required), or if CapAdd contains unnecessary privileges.
Pass: If the container uses CapDrop=ALL or explicitly drops NET_RAW and other unused capabilities.

Remediation

You should restrict the capabilities to the minimum required for the container to function. To remove unneeded capabilities (specifically NET_RAW):

docker run --cap-drop=NET_RAW myimage

The most secure approach is to remove all capabilities and then restore only the ones specifically used:

docker run --cap-drop=all --cap-add=NET_BIND_SERVICE myimage

Getting Started

Product Guides

Integrations

Supported Languages

Vulnerability Reference

Security & Trust

User Management

Ensure Linux Kernel Capabilities Are Restricted (CIS 5.4)

Impact & Risk Analysis

Common Misconfiguration

Vulnerable Example

Secure Example

Audit Procedure

Remediation

​Impact & Risk Analysis

​Common Misconfiguration

​Vulnerable Example

​Secure Example

​Audit Procedure

​Remediation

Impact & Risk Analysis

Common Misconfiguration

Vulnerable Example

Secure Example

Audit Procedure

Remediation