Minimize Admission of Containers Sharing Host PID Namespace (CIS 5.2.3)

​

Impact & Risk Analysis

• Severity: High
• CIS Benchmark: CIS 5.2.3
• Impact: Process Inspection & Privilege Escalation. A container running in the host’s PID namespace (hostPID: true) can inspect all processes running on the host, not just those inside the container. If the container also has ptrace capabilities (which are often default or easily acquired), an attacker can attach to a host process (like systemd or a privileged daemon) and inject code to gain root access to the entire node.

​

Common Misconfiguration

​

Vulnerable Example

# Vulnerable Pod Spec
apiVersion: v1
kind: Pod
metadata:
  name: monitoring-agent
spec:
  # VULNERABLE: Container shares the host Process ID namespace
  # It can see every process running on the server
  hostPID: true
  containers:
  - name: agent
    image: my-agent

​

Secure Example

# Secure Pod Spec
apiVersion: v1
kind: Pod
metadata:
  name: secure-app
spec:
  # SECURE: hostPID is not defined (defaults to false)
  # The container has its own isolated process tree (PID 1 is the app)
  containers:
  - name: app
    image: nginx

​

Audit Procedure

kubectl get pods -A -o=jsonpath=$'{range .items[*]}{@.metadata.name}: {@.spec.hostPID}\n{end}'

• Result: The output will list the pod name followed by its hostPID setting.
• Fail: If you see true for any pod that is not a known, trusted system component (like node-exporter or kube-proxy).

​

Remediation

# Enforce the baseline policy on the 'default' namespace
kubectl label --overwrite ns default pod-security.kubernetes.io/enforce=baseline