Project: KICS (Provisioning / Security & Compliance)
File: a9174d31-d526-4ad9-ace4-ce7ddbf52e03.md

title: Cluster Allows Unsafe Sysctls hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: a9174d31-d526-4ad9-ace4-ce7ddbf52e03 Query name: Cluster Allows Unsafe Sysctls Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Insecure Configurations URL: A Kubernetes Cluster must not allow unsafe sysctls, to prevent a pod from having any influence on any other pod on the node, harming the node's health or gaining CPU or memory resources outside of the resource limits of a pod. This means the 'spec.securitycontext.sysctl' must not have an unsafe sysctls and that the attribute 'allowedunsafe_sysctls' must be undefined.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="6" resource "kubernetespodsecurity_policy" "example" { metadata { name = "terraform-example" } spec { allowedunsafesysctls = ["kernel.msg*"] privileged = false allowprivilegeescalation = false volumes = [ "configMap", "emptyDir", "projected", "secret", "downwardAPI", "persistentVolumeClaim", ] runasuser { rule = "MustRunAsNonRoot" } se_linux { rule = "RunAsAny" } supplemental_groups { rule = "MustRunAs" range { min = 1 max = 65535 } } fs_group { rule = "MustRunAs" range { min = 1 max = 65535 } } readonlyroot_filesystem = true } } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="9" resource "kubernetes_pod" "test" { metadata { name = "terraform-example" } spec { security_context { sysctl = [ { name = "net.core.somaxconn" value = "1024" } ] } container { image = "nginx:1.7.9" name = "example" env { name = "environment" value = "test" } port { container_port = 8080 } liveness_probe { http_get { path = "/nginx_status" port = 80 http_header { name = "X-Custom-Header" value = "Awesome" } } initialdelayseconds = 3 period_seconds = 3 } } dns_config { nameservers = ["1.1.1.1", "8.8.8.8", "9.9.9.9"] searches = ["example.com"] option { name = "ndots" value = 1 } option { name = "use-vc" } } dns_policy = "None" } } ``` ```tf title="Negative test num. 1 - tf file" resource "kubernetespodsecurity_policy" "exampleW" { metadata { name = "terraform-example" } spec { privileged = false allowprivilegeescalation = false volumes = [ "configMap", "emptyDir", "projected", "secret", "downwardAPI", "persistentVolumeClaim", ] runasuser { rule = "MustRunAsNonRoot" } se_linux { rule = "RunAsAny" } supplemental_groups { rule = "MustRunAs" range { min = 1 max = 65535 } } fs_group { rule = "MustRunAs" range { min = 1 max = 65535 } } readonlyroot_filesystem = true } } ``` ```tf title="Negative test num. 2 - tf file" resource "kubernetes_pod" "test2" { metadata { name = "terraform-example" } spec { security_context { sysctl = [ { name = "kernel.shmrmidforced" value = "0" } ] } container { image = "nginx:1.7.9" name = "example" env { name = "environment" value = "test" } port { container_port = 8080 } liveness_probe { http_get { path = "/nginx_status" port = 80 http_header { name = "X-Custom-Header" value = "Awesome" } } initialdelayseconds = 3 period_seconds = 3 } } dns_config { nameservers = ["1.1.1.1", "8.8.8.8", "9.9.9.9"] searches = ["example.com"] option { name = "ndots" value = 1 } option { name = "use-vc" } } dns_policy = "None" } } ```