documentation_complete: true


title: 'Limit Container Running As Root User'

description: |-
    Containers should run as a random non-privileged user.
    To prevent containers from running as root user,
    the appropriate Security Context Constraints (SCCs) should set
    <tt>.runAsUser.type</tt> to <tt>MustRunAsRange</tt>.

rationale: |-
    It is strongly recommended that containers running on OpenShift
    should support running as any arbitrary UID. OpenShift will then assign
    a random, non-privileged UID to the running container instance. This
    avoids the risk from containers running with specific uids that could
    map to host service accounts, or an even greater risk of running as root
    level service.  OpenShift uses the default security context constraints
    (SCC), restricted, to prevent containers from running as root or other
    privileged user ids. Pods may be configured to use an scc policy
    that allows the container to run as a specific uid, including root(0)
    when approved. Only a cluster administrator may grant the change of
    an scc policy.

severity: medium

references:
    cis@ocp4: 5.2.6
    nerc-cip: CIP-003-8 R6,CIP-004-6 R3,CIP-007-3 R6.1
    nist: CM-6,CM-6(1)
    pcidss: Req-2.2
    srg: SRG-APP-000342-CTR-000775

ocil_clause: 'runAsUser.type usage in SCCs needs review'

ocil: |-
    Inspect each SCC and the users and groups allowed to use it returned
    from running the following command:
    <pre>oc get scc -ojson | jq '.items[]|select(.runAsUser.type != "MustRunAsRange" )|.metadata.name,{"Group:":.groups},{"User":.users}'</pre>

    The group "system:authenticated" is the default group for any
    authenticated user, this group should only be associated with the
    restricted profile. If this group is listed under any other SCC Policy,
    or the restricted SCC policy has been altered to allow any of the
    non-permitted actions, this is a finding.

    Next, determine if there are any cluster roles or local roles that allow
    the use of use of non-permitted SCC policies.  The following commands will
    print the Role's name and namespace, followed by a list of resource names
    and if that resource is an SCC.

    > oc get clusterrole.rbac -ojson | jq -r '.items[]|select(.rules[]?|select( (.apiGroups[]? == ("security.openshift.io")) and (.resources[]? == ("securitycontextconstraints")) and (.verbs[]? == ("use"))))|.metadata.name,{"scc":(.rules[]?|select((.resources[]? == ("securitycontextconstraints"))).resourceNames[]?)}'

    > oc get role.rbac --all-namespaces -ojson | jq -r '.items[]|select(.rules[]?|select( (.apiGroups[]? == ("security.openshift.io")) and (.resources[]? == ("securitycontextconstraints")) and (.verbs[]? == ("use"))))|.metadata.name,{"scc":(.rules[]?|select((.resources[]? == ("securitycontextconstraints"))).resourceNames[]?)}'

    Excluding platform specific roles, identify any roles that allow use of non-permitted SCC policies for example the follow output shows that the role 'examplePrivilegedRole' allows use of the 'privileged' SCC.

    <pre>
    examplePrivilegedRole
    {
      "scc": "privileged"
    }
    </pre>

    Finally, determine if there are any role bindings to cluster or local
    roles that allow use of non-permitted SCCs.

    > oc get clusterrolebinding.rbac -ojson | jq -r '.items[]|select(.roleRef.kind == ("ClusterRole","Role") and .roleRef.name == ("[CLUSTER_ROLE_LIST]"))|{ "crb": .metadata.name, "roleRef": .roleRef, "subjects": .subjects}'
    > oc get rolebinding.rbac --all-namespaces -ojson | jq -r '.items[]|select(.roleRef.kind == ("ClusterRole","Role") and .roleRef.name == ("[LOCAL_ROLE_LIST]"))|{ "crb": .metadata.name, "roleRef": .roleRef, "subjects": .subjects}'

    Where "[CLUSTER_ROLE_LIST]" and "[LOCAL_ROLE_LIST]" are
    comma-separated lists of the roles allowing use of non-permitted SCC
    policies as identified above. For example:

    <pre>
    ... .roleRef.name == ("system:openshift:scc:privileged","system:openshift:scc:hostnetwork","system:openshift:scc:hostaccess") ...
    </pre>

    Excluding any platform namespaces (kube-*,openshift-*), if there are any rolebindings to roles that are not permitted, this is a finding.
