documentation_complete: true


title: 'Limit Access to the Host Process ID Namespace'

description: |-
    Containers should not be allowed access to the host's process
    ID namespace. To prevent containers from getting access to a host's
    process ID namespace, the appropriate Security Context Constraints (SCCs)
    should set <tt>allowHostPID</tt> to <tt>false</tt>.

rationale: |-
    A container running in the host's PID namespace can inspect
    processes running outside the container which can be used to
    escalate privileges outside of the container.

severity: medium

references:
    cis@ocp4: 5.2.2
    nerc-cip: CIP-003-8 R6,CIP-004-6 R3,CIP-007-3 R6.1
    nist: CM-6,CM-6(1)
    pcidss: Req-2.2
    srg: SRG-APP-000516-CTR-001325

ocil_clause: 'allowHostPID usage in SCCs needs review'

ocil: |-
    Inspect each SCC returned from running the following command:
    <pre>$ oc get scc</pre>
    Review each SCC for those that have <tt>allowHostPID</tt> set to <tt>true</tt>.
    Next, examine the outputs of the following commands:
    <pre>$ oc describe roles --all-namespaces</pre>
    <pre>$ oc describe clusterroles</pre>
    For any role/clusterrole that reference the
    <tt>securitycontextconstraints</tt> resource with the <tt>resourceNames</tt>
    of the SCCs that have <tt>allowHostPID</tt>, examine the associated
    rolebindings to account for the users that are bound to the role. Review the
    account to determine if <tt>allowHostPID</tt> is truly required.


#template:
#    name: yamlfile_value
#    vars:
#        ocp_data: "true"
#        filepath: /apis/security.openshift.io/v1/securitycontextconstraints
#        yamlpath: ".items[:]['allowHostPID']"
#        check_existence: "at_least_one_exists"
#        entity_check: "at least one"
#        values:
#          - type: "boolean"
#            value: "false"
