Project: KICS (Provisioning / Security & Compliance)
File: 455f2e0c-686d-4fcb-8b5f-3f953f12c43c.md

title: Seccomp Profile Is Not Configured hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 455f2e0c-686d-4fcb-8b5f-3f953f12c43c Query name: Seccomp Profile Is Not Configured Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Configurations URL: Containers should be configured with a secure Seccomp profile to restrict potentially dangerous syscalls<br> ```tf title="Positive test num. 1 - tf file" hl_lines="2 115 348 215 184 249 58 411 284" resource "kubernetes_pod" "pod1" { metadata { name = "terraform-example" } spec { container { image = "nginx:1.7.9" name = "example" env { name = "environment" value = "test" } port { container_port = 8080 } liveness_probe { http_get { path = "/nginx_status" port = 80 http_header { name = "X-Custom-Header" value = "Awesome" } } initialdelayseconds = 3 period_seconds = 3 } } dns_config { nameservers = ["1.1.1.1", "8.8.8.8", "9.9.9.9"] searches = ["example.com"] option { name = "ndots" value = 1 } option { name = "use-vc" } } dns_policy = "None" } } resource "kubernetes_pod" "pod2" { metadata { name = "terraform-example" annotations = { SomeAnnotation = "foobar" } } spec { container { image = "nginx:1.7.9" name = "example" env { name = "environment" value = "test" } port { container_port = 8080 } liveness_probe { http_get { path = "/nginx_status" port = 80 http_header { name = "X-Custom-Header" value = "Awesome" } } initialdelayseconds = 3 period_seconds = 3 } } dns_config { nameservers = ["1.1.1.1", "8.8.8.8", "9.9.9.9"] searches = ["example.com"] option { name = "ndots" value = 1 } option { name = "use-vc" } } dns_policy = "None" } } resource "kubernetes_pod" "pod3" { metadata { name = "terraform-example" annotations = { seccomp.security.alpha.kubernetes.io/defaultProfileName = "rntim/dfl" } } spec { container { image = "nginx:1.7.9" name = "example" env { name = "environment" value = "test" } port { container_port = 8080 } liveness_probe { http_get { path = "/nginx_status" port = 80 http_header { name = "X-Custom-Header" value = "Awesome" } } initialdelayseconds = 3 period_seconds = 3 } } dns_config { nameservers = ["1.1.1.1", "8.8.8.8", "9.9.9.9"] searches =

option { name = "ndots" value = 1 } option { name = "use-vc" } } dns_policy = "None" } } resource "kubernetescronjob" "cron1" { metadata { name = "demo" } spec { concurrency_policy = "Replace" failedjobshistory_limit = 5 schedule = "1 0 *" startingdeadlineseconds = 10 successfuljobshistory_limit = 10 job_template { metadata {} spec { backoff_limit = 2 ttlsecondsafter_finished = 10 template { metadata {} spec { container { name = "hello" image = "busybox" command = ["/bin/sh", "-c", "date; echo Hello from the Kubernetes cluster"] } } } } } } } resource "kubernetescronjob" "cron2" { metadata { name = "demo" } spec { concurrency_policy = "Replace" failedjobshistory_limit = 5 schedule = "1 0 *" startingdeadlineseconds = 10 successfuljobshistory_limit = 10 job_template { metadata {} spec { backoff_limit = 2 ttlsecondsafter_finished = 10 template { metadata { annotations = { SomeAnnotation = "foobar" } } spec { container { name = "hello" image = "busybox" command = ["/bin/sh", "-c", "date; echo Hello from the Kubernetes cluster"] } } } } } } } resource "kubernetescronjob" "cron3" { metadata { name = "demo" } spec { concurrency_policy = "Replace" failedjobshistory_limit = 5 schedule = "1 0 *" startingdeadlineseconds = 10 successfuljobshistory_limit = 10 job_template { metadata {} spec { backoff_limit = 2 ttlsecondsafter_finished = 10 template { metadata { annotations = { seccomp.security.alpha.kubernetes.io/defaultProfileName = "rntim/dfl" } } spec { container { name = "hello" image = "busybox" command = ["/bin/sh", "-c", "date; echo Hello from the Kubernetes cluster"] } } } } } } } resource "kubernetes_deployment" "deployment1" { metadata { name = "terraform-example" labels = { test = "MyExampleApp" } } spec { replicas = 3 selector { match_labels = { test = "MyExampleApp" } } template { metadata { labels = { test = "MyExampleApp" } } spec { container { image = "nginx:1.7.8" name = "example" resources { limits = { cpu = "0.5" memory = "512Mi" } requests = { cpu = "250m" memory = "50Mi" } } liveness_probe { http_get { path = "/nginx_status" port = 80 http_header { name = "X-Custom-Header" value = "Awesome" } } initialdelayseconds = 3 period_seconds = 3 } } } } } } resource "kubernetes_deployment" "deployment2" { metadata { name = "terraform-example" labels = { test = "MyExampleApp" } } spec { replicas = 3 selector { match_labels = { test = "MyExampleApp" } } template { metadata { labels = { test = "MyExampleApp" } annotations = { SomeAnnotation = "foobar" } } spec { container { image = "nginx:1.7.8" name = "example" resources { limits = { cpu =

memory = "512Mi" } requests = { cpu = "250m" memory = "50Mi" } } liveness_probe { http_get { path = "/nginx_status" port = 80 http_header { name = "X-Custom-Header" value = "Awesome" } } initialdelayseconds = 3 period_seconds = 3 } } } } } } resource "kubernetes_deployment" "deployment3" { metadata { name = "terraform-example" labels = { test = "MyExampleApp" } } spec { replicas = 3 selector { match_labels = { test = "MyExampleApp" } } template { metadata { labels = { test = "MyExampleApp" } annotations = { seccomp.security.alpha.kubernetes.io/defaultProfileName = "rntim/dfl" } } spec { container { image = "nginx:1.7.8" name = "example" resources { limits = { cpu = "0.5" memory = "512Mi" } requests = { cpu = "250m" memory = "50Mi" } } liveness_probe { http_get { path = "/nginx_status" port = 80 http_header { name = "X-Custom-Header" value = "Awesome" } } initialdelayseconds = 3 period_seconds = 3 } } } } } } ``` ```tf title="Negative test num. 1 - tf file" resource "kubernetes_pod" "pod" { metadata { name = "terraform-example" annotations = { seccomp.security.alpha.kubernetes.io/defaultProfileName = "runtime/default" } } spec { container { image = "nginx:1.7.9" name = "example" env { name = "environment" value = "test" } port { container_port = 8080 } liveness_probe { http_get { path = "/nginx_status" port = 80 http_header { name = "X-Custom-Header" value = "Awesome" } } initialdelayseconds = 3 period_seconds = 3 } } dns_config { nameservers = ["1.1.1.1", "8.8.8.8", "9.9.9.9"] searches = ["example.com"] option { name = "ndots" value = 1 } option { name = "use-vc" } } dns_policy = "None" } } resource "kubernetescronjob" "cron" { metadata { name = "demo" } spec { concurrency_policy = "Replace" failedjobshistory_limit = 5 schedule = "1 0 *" startingdeadlineseconds = 10 successfuljobshistory_limit = 10 job_template { metadata {} spec { backoff_limit = 2 ttlsecondsafter_finished = 10 template { metadata { annotations = { seccomp.security.alpha.kubernetes.io/defaultProfileName = "runtime/default" } } spec { container { name = "hello" image = "busybox" command = ["/bin/sh", "-c", "date; echo Hello from the Kubernetes cluster"] } } } } } } } resource "kubernetes_deployment" "deployment" { metadata { name = "terraform-example" labels = { test = "MyExampleApp" } } spec { replicas = 3 selector { match_labels = { test = "MyExampleApp" } } template { metadata { labels = { test = "MyExampleApp" } annotations = { seccomp.security.alpha.kubernetes.io/defaultProfileName = "runtime/default" } } spec { container { image = "nginx:1.7.8" name = "example" resources { limits = { cpu = "0.5" memory = "512Mi" } requests = { cpu = "250m" memory = "50Mi" } } liveness_probe { http_get { path = "/nginx_status" port = 80 http_header { name = "X-Custom-Header" value = "Awesome" } } initialdelayseconds = 3 period_seconds = 3 } } } } } } ```