Project: KICS (Provisioning / Security & Compliance)
File: 2270987f-bb51-479f-b8be-3ca73e5ad648.md

title: NET_RAW Capabilities Disabled for PSP hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 2270987f-bb51-479f-b8be-3ca73e5ad648 Query name: NET_RAW Capabilities Disabled for PSP Platform: Kubernetes Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Configurations URL: Containers need to have NET_RAW or All as drop capabilities<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="57 13" apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: restricted annotations: seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default' apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default' seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default' apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default' spec: privileged: false allowPrivilegeEscalation: false requiredDropCapabilities: SYS_TIME SYS_ADMIN KILL volumes: 'configMap' 'emptyDir' 'projected' 'secret' 'downwardAPI' 'persistentVolumeClaim' hostNetwork: false hostIPC: false hostPID: false runAsUser: rule: 'MustRunAsNonRoot' seLinux: rule: 'RunAsAny' supplementalGroups: rule: 'MustRunAs' ranges: min: 1 max: 65535 fsGroup: rule: 'MustRunAs' ranges: min: 1 max: 65535 readOnlyRootFilesystem: false apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: restricted2 annotations: seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default' apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default' seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default' apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default' spec: privileged: false allowPrivilegeEscalation: false requiredDropCapabilities: KILL volumes: 'configMap' 'emptyDir' 'projected' 'secret' 'downwardAPI' 'persistentVolumeClaim' hostNetwork: false hostIPC: false hostPID: false runAsUser: rule: 'MustRunAsNonRoot' seLinux: rule: 'RunAsAny' supplementalGroups: rule: 'MustRunAs' ranges: min: 1 max: 65535 fsGroup: rule: 'MustRunAs' ranges: min: 1 max: 65535 readOnlyRootFilesystem: false ``` ```yaml title="Negative test num. 1 - yaml file" apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: restricted annotations: seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default' apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default' seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default' apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default' spec: privileged: false allowPrivilegeEscalation: false requiredDropCapabilities: ALL volumes: 'configMap' 'emptyDir' 'projected' 'secret' 'downwardAPI' 'persistentVolumeClaim' hostNetwork: false hostIPC: false hostPID: false runAsUser: rule: 'MustRunAsNonRoot' seLinux: rule: 'RunAsAny' supplementalGroups: rule: 'MustRunAs' ranges: min: 1 max: 65535 fsGroup: rule: 'MustRunAs' ranges: min: 1 max: 65535 readOnlyRootFilesystem: false ```