Repository: prowler-cloud/prowler
Issue category: Bug Report

Issue:
CIS 1.8 5.7.2 fails even though seccomp profile is set to runTimeDefault
### Steps to Reproduce

1. Create a Pod with securityContext.seccompProfile.type: RunTimeDefault
2. Run Prowler
3. Prowler will complain on "Pod <pod name> does not have docker/default seccomp profile enabled."

### Expected behavior

CIS 1.8 5.7.2 states "Remediation: Use securityContext to enable the docker/default seccomp profile in your pod definitions. An example is as below: securityContext: seccompProfile: type: RuntimeDefault"

From the Talos documentation (from version 1.2.0 and above): Talos now runs Kubelet with the CRI default Seccomp Profile enabled.
This can be disabled by setting .machine.kubelet.defaultRuntimeSeccompProfileEnabled to false.

I've checked that its set to true on all nodes.

### Actual Result with Screenshots or Logs

pod manifest
```
kubectl -n kube-system get pod kube-apiserver-controlplane1 -ojsonpath='{.spec.containers[*].securityContext}'

{"allowPrivilegeEscalation":false,"capabilities":{"add":["NET_BIND_SERVICE"],"drop":["ALL"]},"seccompProfile":{"type":"RuntimeDefault"}}
```

prowler json
```
"message": "Pod kube-apiserver-controlplane1 does not have docker/default seccomp profile enabled.",
    "status_detail": "Pod kube-apiserver-controlplane1 does not have docker/default seccomp profile enabled.",
```

### How did you install Prowler?

From brew (brew install prowler)

### Environment Resource

Workstation

### OS used

macOS 15.1

### Prowler version

4.5.3

### Pip version

24.3.1

### Context

_No response_


Hints:
Hey! @misterdohl thanks for the ping. Requirement `5.7.2` is associated with the check `core_seccomp_profile_docker_default`. Based on the information you’ve provided, I can see that a modification will be needed to improve it. I’ll let you know as soon as the change is made!

Patch:
diff --git a/prowler/providers/kubernetes/services/core/core_seccomp_profile_docker_default/core_seccomp_profile_docker_default.py b/prowler/providers/kubernetes/services/core/core_seccomp_profile_docker_default/core_seccomp_profile_docker_default.py
index 71c4a7f28af..20a9c16b2fb 100644
--- a/prowler/providers/kubernetes/services/core/core_seccomp_profile_docker_default/core_seccomp_profile_docker_default.py
+++ b/prowler/providers/kubernetes/services/core/core_seccomp_profile_docker_default/core_seccomp_profile_docker_default.py
@@ -10,18 +10,38 @@ def execute(self) -> Check_Report_Kubernetes:
             report.namespace = pod.namespace
             report.resource_name = pod.name
             report.resource_id = pod.uid
-            if (
+
+            pod_seccomp_correct = (
                 pod.security_context
                 and pod.security_context.seccomp_profile
                 and pod.security_context.seccomp_profile.type == "RuntimeDefault"
-            ):
+            )
+            containers_seccomp_correct = True
+
+            # Check container-level seccomp profile
+            for container in pod.containers.values():
+                if not (
+                    container.security_context
+                    and container.security_context.seccomp_profile
+                    and container.security_context.seccomp_profile.type
+                    == "RuntimeDefault"
+                ):
+                    containers_seccomp_correct = False
+                    break
+
+            # Determine the report status
+            if pod_seccomp_correct or containers_seccomp_correct:
                 report.status = "PASS"
-                report.status_extended = (
-                    f"Pod {pod.name} has docker/default seccomp profile enabled."
-                )
+                report.status_extended = f"Pod {pod.name} and its containers have docker/default seccomp profile enabled."
             else:
                 report.status = "FAIL"
-                report.status_extended = f"Pod {pod.name} does not have docker/default seccomp profile enabled."
+                if not pod_seccomp_correct and not containers_seccomp_correct:
+                    report.status_extended = f"Pod {pod.name} does not have docker/default seccomp profile enabled at both pod and container levels."
+                elif not pod_seccomp_correct:
+                    report.status_extended = f"Pod {pod.name} does not have docker/default seccomp profile enabled at pod level."
+                else:
+                    report.status_extended = f"Pod {pod.name} does not have docker/default seccomp profile enabled at container level."
+
             findings.append(report)
 
         return findings


Test patch: