documentation_complete: true


title: 'Drop Container Capabilities'

description: |-
    Containers should not enable more capabilities than needed as this
    opens the door for malicious use. To disable the
    capabilities, the appropriate Security Context Constraints (SCCs)
    should set all capabilities as <tt>*</tt> or a list of capabilities in
    <tt>requiredDropCapabilities</tt>.

rationale: |-
    By default, containers run with a default set of capabilities as assigned
    by the Container Runtime which can include dangerous or highly privileged
    capabilities. Capabilities should be dropped unless absolutely critical for
    the container to run software as added capabilities that are not required
    allow for malicious containers or attackers.

severity: medium

references:
    cis@ocp4: 5.2.9
    nerc-cip: CIP-003-8 R6,CIP-004-6 R3,CIP-007-3 R6.1
    nist: CM-6,CM-6(1)
    pcidss: Req-2.2
    srg: SRG-APP-000516-CTR-001325

ocil_clause: 'requiredDropCapabilities use in SCCs needs review'

ocil: |-
    Inspect each SCC returned from running the following command:
    <pre>$ oc get scc</pre>
    Next, examine the outputs of the following commands:
    <pre>$ oc describe roles --all-namespaces</pre>
    <pre>$ oc describe clusterroles</pre>
    For any role/clusterrole that reference the
    <tt>securitycontextconstraints</tt> resource with the <tt>resourceNames</tt>
    of the SCCs that do not list any <tt>requiredDropCapabilities</tt>, examine the
    associated rolebindings to account for the users that are bound to the role.
    Review each SCC and determine that all capabilities are either
    completely disabled as a list entry under <tt>requiredDropCapabilities</tt>,
    or that all the un-required capabilities are dropped for containers and SCCs.

#template:
#    name: yamlfile_value
#    vars:
#        ocp_data: "true"
#        filepath: /apis/security.openshift.io/v1/securitycontextconstraints
#        yamlpath: ".items[:]['requiredDropCapabilities','#'][:]"
#        check_existence: "at_least_one_exists"
#        entity_check: "at least one"
#        values:
#          - key: "requiredDropCapabilities"
#            value: "^ALL$"
#            entity_check: "at least one"
#            operation: "pattern match"
