Project: KICS (Provisioning / Security & Compliance)
File: a62a99d1-8196-432f-8f80-3c100b05d62a.md

title: Volume Mount With OS Directory Write Permissions hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: a62a99d1-8196-432f-8f80-3c100b05d62a Query name: Volume Mount With OS Directory Write Permissions Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Resource Management URL: Containers can mount sensitive folders from the hosts, giving them potentially dangerous access to critical host configurations and binaries.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="8" resource "kubernetes_pod" "test" { metadata { name = "terraform-example" } spec { container { volume_mount { name = "config-volume" mount_path = "/bin" } image = "nginx:1.7.9" name = "example" env { name = "environment" value = "test" } port { container_port = 8080 } liveness_probe { http_get { path = "/nginx_status" port = 80 http_header { name = "X-Custom-Header" value = "Awesome" } } initialdelayseconds = 3 period_seconds = 3 } } dns_config { nameservers = ["1.1.1.1", "8.8.8.8", "9.9.9.9"] searches = ["example.com"] option { name = "ndots" value = 1 } option { name = "use-vc" } } dns_policy = "None" } } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="11" resource "kubernetes_pod" "test2" { metadata { name = "terraform-example" } spec { container { volume_mount { name = "config-volume" mount_path = "/bin" read_only = false } image = "nginx:1.7.9" name = "example" env { name = "environment" value = "test" } port { container_port = 8080 } liveness_probe { http_get { path = "/nginx_status" port = 80 http_header { name = "X-Custom-Header" value = "Awesome" } } initialdelayseconds = 3 period_seconds = 3 } } dns_config { nameservers = ["1.1.1.1", "8.8.8.8", "9.9.9.9"] searches = ["example.com"] option { name = "ndots" value = 1 } option { name = "use-vc" } } dns_policy = "None" } } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="12" resource "kubernetes_pod" "test3" { metadata { name = "terraform-example" } spec { container { volume_mount = [ { name = "config-volume" mount_path = "/bin" read_only = false } ] image = "nginx:1.7.9" name = "example" env { name = "environment" value = "test" } port { container_port = 8080 } liveness_probe { http_get { path = "/nginx_status" port = 80 http_header { name = "X-Custom-Header" value = "Awesome" } } initialdelayseconds = 3 period_seconds = 3 } } dns_config { nameservers = ["1.1.1.1", "8.8.8.8", "9.9.9.9"] searches = ["example.com"] option { name = "ndots" value = 1 } option { name = "use-vc" } } dns_policy = "None" } } ``` ```tf title="Negative test num. 1 - tf file" resource "kubernetes_pod" "testttt" { metadata { name = "terraform-example" } spec { container { volume_mount { name = "config-volume" mount_path = "/etc/config" read_only = true } image = "nginx:1.7.9" name = "example" env { name = "environment" value = "test" } port { container_port = 8080 } liveness_probe { http_get { path = "/nginx_status" port = 80 http_header { name = "X-Custom-Header" value = "Awesome" } } initialdelayseconds = 3 period_seconds = 3 } } dns_config { nameservers = ["1.1.1.1", "8.8.8.8", "9.9.9.9"] searches = ["example.com"] option { name = "ndots" value = 1 } option { name = "use-vc" } } dns_policy = "None" } } ```