Project: KICS (Provisioning / Security & Compliance)
File: f377b83e-bd07-4f48-a591-60c82b14a78b.md

title: Seccomp Profile Is Not Configured hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: f377b83e-bd07-4f48-a591-60c82b14a78b Query name: Seccomp Profile Is Not Configured Platform: Kubernetes Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Configurations URL: Containers should be configured with a secure Seccomp profile to restrict potentially dangerous syscalls<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="43 18 26 7" apiVersion: v1 kind: Pod metadata: name: pod-test-1 spec: containers: name: foobar image: foo/bar:latest apiVersion: v1 kind: Pod metadata: name: pod-test-2 annotations: some-annotation: myannotation spec: containers: name: foobar image: foo/bar:latest apiVersion: v1 kind: Pod metadata: name: pod-test-3 annotations: seccomp.security.alpha.kubernetes.io/defaultProfileName: 'rntim/dfl' spec: containers: name: foobar image: foo/bar:latest apiVersion: batch/v1beta1 kind: CronJob metadata: name: hello spec: schedule: "/1 *" jobTemplate: spec: template: metadata: annotations: seccomp.security.alpha.kubernetes.io/defaultProfileName: 'rntim/dfl' spec: containers: name: hello image: busybox imagePullPolicy: IfNotPresent args: /bin/sh -c date; echo Hello from the Kubernetes cluster restartPolicy: OnFailure ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="24" apiVersion: apps/v1 kind: Deployment metadata: name: securitydemo labels: app: web spec: replicas: 2 selector: matchLabels: app: web template: metadata: labels: app: web spec: securityContext: runAsUser: 19000 containers: name: frontend image: nginx ports: containerPort: 80 securityContext: allowPrivilegeEscalation: false name: echoserver image: k8s.gcr.io/echoserver:1.4 ports: containerPort: 8080 securityContext: allowPrivilegeEscalation: false seccompProfile: type: RuntimeDefault ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="24 33" apiVersion: apps/v1 kind: Deployment metadata: name: securitydemo labels: app: web spec: replicas: 2 selector: matchLabels: app: web template: metadata: labels: app: web spec: securityContext: runAsUser: 19000 containers: name: frontend image: nginx ports: containerPort: 80 securityContext: allowPrivilegeEscalation: false name: echoserver image: k8s.gcr.io/echoserver:1.4 ports: containerPort: 8080 securityContext: allowPrivilegeEscalation: false seccompProfile: type: Unconfined ``` <details><summary>Positive test num. 4 - yaml file</summary> ```yaml hl_lines="35" apiVersion: apps/v1 kind: Deployment metadata: name: securitydemo labels: app: web spec: replicas: 2 selector: matchLabels: app: web template: metadata: labels: app: web spec: securityContext: runAsUser: 19000 seccompProfile: type: RuntimeDefault containers: name: frontend image: nginx ports: containerPort: 80 securityContext: allowPrivilegeEscalation: false name: echoserver image: k8s.gcr.io/echoserver:1.4 ports: containerPort: 8080 securityContext: allowPrivilegeEscalation: false seccompProfile: type: Unconfined ``` </details> ```yaml title="Negative test num. 1 - yaml file" apiVersion: v1 kind: Pod metadata: name: pod-test-1 annotations: seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default' spec: containers: name: foobar image: foo/bar:latest ``` ```yaml title="Negative test num. 2 - yaml file" apiVersion: apps/v1 kind: Deployment metadata: name: securitydemo labels: app: web spec: replicas: 2 selector: matchLabels: app: web template: metadata: labels: app: web spec: securityContext: runAsUser: 19000 seccompProfile: type: RuntimeDefault containers: name: frontend image: nginx ports: containerPort: 80 securityContext: allowPrivilegeEscalation: false name: echoserver image: k8s.gcr.io/echoserver:1.4 ports: containerPort: 8080 securityContext: allowPrivilegeEscalation: false ``` ```yaml title="Negative test num. 3 - yaml file" apiVersion: apps/v1 kind: Deployment metadata: name: securitydemo labels: app: web spec: replicas: 2 selector: matchLabels: app: web template: metadata: labels: app: web spec: securityContext: runAsUser: 19000 containers: name: frontend image: nginx ports: containerPort: 80 securityContext: allowPrivilegeEscalation: false seccompProfile: type: RuntimeDefault name: echoserver image: k8s.gcr.io/echoserver:1.4 ports: containerPort: 8080 securityContext: allowPrivilegeEscalation: false seccompProfile: type: RuntimeDefault ```