documentation_complete: true


title: 'Limit Container Capabilities'

description: |-
    <p>
    Containers should not enable more capabilites than needed as this
    opens the door for malicious use. To enable only the
    required capabilities, the appropriate Security Context Constraints (SCCs)
    should set capabilities as a list in <tt>allowedCapabilities</tt>.
    </p>
    <p>
    In case an SCC outside the default allow list in the variable
    <tt>var-sccs-with-allowed-capabilities-regex</tt> is being flagged,
    create a <tt>TailoredProfile</tt> and add the additional SCC to the
    regular expression in the variable <tt>var-sccs-with-allowed-capabilities-regex</tt>.
    An example allowing an SCC named <tt>additional</tt> follows:
    </p>
    <pre>
    apiVersion: compliance.openshift.io/v1alpha1
    kind: TailoredProfile
    metadata:
      name: cis-additional-scc
    spec:
      description: Allows an additional scc
      setValues:
      - name: ocp4-var-sccs-with-allowed-capabilities-regex
        rationale: Allow our own custom SCC
        value: ^privileged$|^hostnetwork-v2$|^restricted-v2$|^nonroot-v2$|^additional$
      extends: ocp4-cis
      title: Modified CIS allowing one more SCC
    </pre>
    <p>
    Finally, reference this <tt>TailoredProfile</tt> in a <tt>ScanSettingBinding</tt>
    For more information on Tailoring the Compliance Operator, please consult the
    OpenShift documentation:
      {{{ weblink(link="https://docs.openshift.com/container-platform/latest/security/compliance_operator/co-scans/compliance-operator-tailor.html") }}}
    </p>

rationale: |-
    By default, containers run with a default set of capabilities as assigned
    by the Container Runtime which can include dangerous or highly privileged
    capabilities. Capabilities should be dropped unless absolutely critical for
    the container to run software as added capabilities that are not required
    allow for malicious containers or attackers.

{{% set jqfilter = '[.items[] | select(.metadata.name | test("{{.var_sccs_with_allowed_capabilities_regex}}"; "") | not) | select(.allowedCapabilities != null) | .metadata.name]' %}}

severity: medium

references:
    cis@ocp4: 5.2.8
    nerc-cip: CIP-003-8 R6,CIP-004-6 R3,CIP-007-3 R6.1
    nist: CM-6,CM-6(1)
    pcidss: Req-2.2
    srg: SRG-APP-000516-CTR-001325

ocil_clause: 'allowed capabilities listings in SCCs needs review'

ocil: |-
    This rule checks the SCCs with allowedCapabilities set to non-null
    and fails if there are more such SCCs than those allowed in the variable
    named ocp4-var-sccs-with-allowed-capabilities-regex. To debug the rule,
    check the variable value, e.g:
    <pre>$ oc get variable ocp4-var-sccs-with-allowed-capabilities-regex  -ojsonpath='{.value}' </pre>
    Then use following command to list the SCCs that would fail the test:
    <tt>{{{ ocil_oc_pipe_jq_filter('scc', jqfilter) }}}</tt>
    Please replace the regular expression in the test command with the value read from the variable
    <pre>ocp4-var-sccs-with-allowed-capabilities-regex</pre>. You can read the variable
    value with:
    <pre>$ oc get variable ocp4-var-sccs-with-allowed-capabilities-regex -ojsonpath='{.value}' -n openshift-compliance </pre>


warnings:
- general: |-
    {{{ openshift_filtered_cluster_setting({'/apis/security.openshift.io/v1/securitycontextconstraints': jqfilter}) | indent(4) }}}

template:
    name: yamlfile_value
    vars:
        ocp_data: "true"
        filepath: "{{{ openshift_filtered_path('/apis/security.openshift.io/v1/securitycontextconstraints', jqfilter) }}}"
        yamlpath: "[:]"
        check_existence: "none_exist"
        entity_check: "all"
        values:
          - value: "(.*?)"
            operation: "pattern match"
