Minimize Admission of Containers with Capabilities Assigned (CIS 5.2.9)

​

Impact & Risk Analysis

• Severity: Medium (Level 2 - Defense in Depth)
• CIS Benchmark: CIS 5.2.9
• Impact: Reduced Attack Surface. Linux Capabilities break down the “root” privilege into smaller units (like CHOWN, KILL, NET_BIND_SERVICE). Default container runtimes grant a set of default capabilities that are unnecessary for most web applications. If an attacker compromises a container, they can use these capabilities to manipulate files, processes, or network settings. Dropping all capabilities ensures the process has the absolute minimum rights required to run.

​

Common Misconfiguration

​

Vulnerable Example

# Vulnerable Pod Spec
apiVersion: v1
kind: Pod
metadata:
  name: default-caps-pod
spec:
  containers:
  - name: app
    image: nginx
    # VULNERABLE: No securityContext defined.
    # Inherits all default runtime capabilities.

​

Secure Example

# Secure Pod Spec
apiVersion: v1
kind: Pod
metadata:
  name: least-privilege-pod
spec:
  containers:
  - name: app
    image: nginx
    securityContext:
      capabilities:
        # SECURE: Drop ALL default capabilities
        drop:
          - ALL

​

Audit Procedure

# Check if capabilities are dropped
kubectl get pods -A -o=jsonpath=$'{range .items[*]}{@.metadata.name}: {@.spec.containers[*].securityContext.capabilities.drop}\n{end}'

• Analyze: Look for ALL.
• Fail: If the output is empty or does not contain ALL.

kubectl get ns --show-labels

​

Remediation

1. Update Application Manifests: Modify your Deployment YAMLs to explicitly drop all capabilities.
2. Enforce Policy: Apply the restricted Pod Security Standard to your namespaces.

# Enforce the restricted policy (requires drop: ["ALL"])
kubectl label --overwrite ns default pod-security.kubernetes.io/enforce=restricted