Repository: intel/intel-device-plugins-for-kubernetes
Pull request #906 (2022-02-25 00:03:07)

implement terrascan check
Fixes: #712

bart0sh: @mythi do you still have any doubts/objections regarding this PR. If not, please merge.
mythi: @bart0sh I could merge but did you plan to add it to `Jenkinsfile` too?
bart0sh: @mythi sure, will do. Totally forgot about it, sorry.

Patch:
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 3a0dffa0..8bc48c37 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -50,7 +50,7 @@ jobs:
           sudo apt-get update
           sudo apt-get -y install libusb-1.0-0-dev
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v3
+        uses: golangci/golangci-lint-action@v2
         with:
           version: v1.43.0
           args: -v --timeout 5m
@@ -166,3 +166,17 @@ jobs:
       - name: Test SGX & FPGA Admission Webhook, Deploy Operator
         run: |
           make test-with-kind
+
+  terrascan:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v2
+    - name: Install terrascan
+      run: |
+        curl -L "$(curl -s https://api.github.com/repos/accurics/terrascan/releases/latest | grep -o -E "https://.+?_Linux_x86_64.tar.gz")" > terrascan.tar.gz
+        tar -xf terrascan.tar.gz terrascan && rm terrascan.tar.gz
+        install terrascan /usr/local/bin && rm terrascan
+    - name: Run Terrascan
+      run: make terrascan
+
diff --git a/Jenkinsfile b/Jenkinsfile
index 5413e5b2..f3ca46d6 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -67,6 +67,15 @@ pipeline {
         }
         stage("make lint"){
           parallel {
+            stage("make terrascan") {
+              steps {
+                dir(path: "$REPO_DIR") {
+                  sh "curl -sL `curl -s https://api.github.com/repos/accurics/terrascan/releases/latest | grep -o -E https://.+?_Linux_x86_64.tar.gz` | tar -zx terrascan"
+                  sh "sudo mv terrascan /usr/local/bin/"
+                  sh "make terrascan"
+                }
+              }
+            }
             stage("make lint") {
               steps {
                 dir(path: "$REPO_DIR") {
diff --git a/Makefile b/Makefile
index f492e218..26e195b7 100644
--- a/Makefile
+++ b/Makefile
@@ -148,6 +148,15 @@ e2e-sgx:
 e2e-gpu:
 	@$(GO) test -v ./test/e2e/... -ginkgo.v -ginkgo.progress -ginkgo.focus "GPU" -delete-namespace-on-failure=false
 
+terrascan:
+	@ls deployments/*/kustomization.yaml | while read f ; \
+	do \
+		echo "\n==== $$(basename $$(dirname $$f)) ====" ; \
+		terrascan scan -v --show-passed -d $$(dirname $$f) -i kustomize --severity high \
+		--skip-rules 'AC_K8S_0051,AC_K8S_0076,AC_K8S_0087' \
+		|| exit $$? ; \
+	done
+
 pre-pull:
 ifeq ($(TAG),devel)
 	@$(BUILDER) pull golang:1.17-bullseye
@@ -158,11 +167,6 @@ endif
 
 images = $(shell basename -s .Dockerfile -a build/docker/*.Dockerfile)
 
-skipbaselayercheck = intel-vpu-plugin intel-qat-plugin-kerneldrv intel-idxd-config-initcontainer
-distroless_images = $(patsubst %,$(REG)%\:$(TAG),$(filter-out $(skipbaselayercheck),$(images)))
-test-image-base-layer:
-	@for img in $(distroless_images); do scripts/test-image-base-layer.sh $$img $(BUILDER) || exit 1; done
-
 $(images):
 	@build/docker/build-image.sh $(REG)$@ $(BUILDER) $(EXTRA_BUILD_ARGS)
 
@@ -179,7 +183,7 @@ image_tags = $(patsubst %,$(REG)%\:$(TAG),$(images) $(demos))
 $(image_tags):
 	@docker push $@
 
-push: test-image-base-layer $(image_tags)
+push: $(image_tags)
 
 lock-images:
 	@scripts/update-clear-linux-base.sh clearlinux:latest $(shell find demo -name Dockerfile)
@@ -197,7 +201,7 @@ check-github-actions:
 	jq -e '$(images_json) - .jobs.image.strategy.matrix.image == []' > /dev/null || \
 	(echo "Make sure all images are listed in .github/workflows/ci.yaml"; exit 1)
 
-.PHONY: all format test lint build images $(cmds) $(images) lock-images vendor pre-pull set-version check-github-actions envtest fixture update-fixture install-tools test-image-base-layer
+.PHONY: all format test lint build images $(cmds) $(images) lock-images vendor pre-pull set-version check-github-actions envtest fixture update-fixture install-tools
 
 SPHINXOPTS    =
 SPHINXBUILD   = sphinx-build
diff --git a/deployments/dlb_plugin/base/intel-dlb-plugin.yaml b/deployments/dlb_plugin/base/intel-dlb-plugin.yaml
index 9aa5f4f6..60adf69b 100644
--- a/deployments/dlb_plugin/base/intel-dlb-plugin.yaml
+++ b/deployments/dlb_plugin/base/intel-dlb-plugin.yaml
@@ -24,6 +24,7 @@ spec:
         imagePullPolicy: IfNotPresent
         securityContext:
           readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
         terminationMessagePath: /tmp/termination-log          
         volumeMounts:
         - name: devfs
diff --git a/deployments/dsa_plugin/base/intel-dsa-plugin.yaml b/deployments/dsa_plugin/base/intel-dsa-plugin.yaml
index 8b3aa910..a7a3d605 100644
--- a/deployments/dsa_plugin/base/intel-dsa-plugin.yaml
+++ b/deployments/dsa_plugin/base/intel-dsa-plugin.yaml
@@ -24,6 +24,7 @@ spec:
         imagePullPolicy: IfNotPresent
         securityContext:
           readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
         volumeMounts:
         - name: devfs
           mountPath: /dev/dsa
diff --git a/deployments/fpga_admissionwebhook/kustomization.yaml b/deployments/fpga_admissionwebhook/kustomization.yaml
new file mode 100644
index 00000000..f191f3aa
--- /dev/null
+++ b/deployments/fpga_admissionwebhook/kustomization.yaml
@@ -0,0 +1,2 @@
+bases:
+  - base
diff --git a/deployments/fpga_admissionwebhook/manager/manager.yaml b/deployments/fpga_admissionwebhook/manager/manager.yaml
index 1b311eea..0cfab45f 100644
--- a/deployments/fpga_admissionwebhook/manager/manager.yaml
+++ b/deployments/fpga_admissionwebhook/manager/manager.yaml
@@ -24,6 +24,7 @@ spec:
           runAsUser: 65532
           runAsGroup: 65532
           readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
         resources:
           limits:
             cpu: 100m
diff --git a/deployments/fpga_plugin/base/intel-fpga-plugin-daemonset.yaml b/deployments/fpga_plugin/base/intel-fpga-plugin-daemonset.yaml
index 6c64bdb5..f68e12e6 100644
--- a/deployments/fpga_plugin/base/intel-fpga-plugin-daemonset.yaml
+++ b/deployments/fpga_plugin/base/intel-fpga-plugin-daemonset.yaml
@@ -20,6 +20,7 @@ spec:
         imagePullPolicy: IfNotPresent
         securityContext:
           readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
         volumeMounts:
         - mountPath: /opt/intel/fpga-sw
           name: intel-fpga-sw
@@ -39,6 +40,7 @@ spec:
         terminationMessagePath: /tmp/termination-log
         securityContext:
           readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
         volumeMounts:
         - name: devfs
           mountPath: /dev
diff --git a/deployments/fpga_plugin/kustomization.yaml b/deployments/fpga_plugin/kustomization.yaml
new file mode 100644
index 00000000..197c7292
--- /dev/null
+++ b/deployments/fpga_plugin/kustomization.yaml
@@ -0,0 +1,2 @@
+resources:
+  - base
diff --git a/deployments/gpu_plugin/base/intel-gpu-plugin.yaml b/deployments/gpu_plugin/base/intel-gpu-plugin.yaml
index 29c00882..1d1d184b 100644
--- a/deployments/gpu_plugin/base/intel-gpu-plugin.yaml
+++ b/deployments/gpu_plugin/base/intel-gpu-plugin.yaml
@@ -19,6 +19,7 @@ spec:
         imagePullPolicy: IfNotPresent
         securityContext:
           readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
         volumeMounts:
         - mountPath: /etc/kubernetes/node-feature-discovery/source.d/
           name: nfd-source-hooks
@@ -33,6 +34,7 @@ spec:
         imagePullPolicy: IfNotPresent
         securityContext:
           readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
         volumeMounts:
         - name: devfs
           mountPath: /dev/dri
diff --git a/deployments/operator/default/manager_auth_proxy_patch.yaml b/deployments/operator/default/manager_auth_proxy_patch.yaml
index 8ba668ce..b27b4b0f 100644
--- a/deployments/operator/default/manager_auth_proxy_patch.yaml
+++ b/deployments/operator/default/manager_auth_proxy_patch.yaml
@@ -24,6 +24,7 @@ spec:
           runAsUser: 1000
           runAsGroup: 1000
           readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
       - name: manager
         args:
         - "--metrics-addr=127.0.0.1:8080"
diff --git a/deployments/operator/kustomization.yaml b/deployments/operator/kustomization.yaml
new file mode 100644
index 00000000..a3be3255
--- /dev/null
+++ b/deployments/operator/kustomization.yaml
@@ -0,0 +1,4 @@
+bases:
+  - default
+  - manager
+  - webhook
diff --git a/deployments/operator/manager/manager.yaml b/deployments/operator/manager/manager.yaml
index 21c42636..35bc8e8c 100644
--- a/deployments/operator/manager/manager.yaml
+++ b/deployments/operator/manager/manager.yaml
@@ -38,6 +38,7 @@ spec:
           runAsUser: 65532
           runAsGroup: 65532
           readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
         env:
           - name: DEVICEPLUGIN_NAMESPACE
             valueFrom:
diff --git a/deployments/qat_dpdk_app/base/crypto-perf-dpdk-pod-requesting-qat.yaml b/deployments/qat_dpdk_app/base/crypto-perf-dpdk-pod-requesting-qat.yaml
index d7c8b3d2..55b72894 100644
--- a/deployments/qat_dpdk_app/base/crypto-perf-dpdk-pod-requesting-qat.yaml
+++ b/deployments/qat_dpdk_app/base/crypto-perf-dpdk-pod-requesting-qat.yaml
@@ -27,6 +27,7 @@ spec:
         hugepages-2Mi: "128Mi"
     securityContext:
       readOnlyRootFilesystem: true
+      allowPrivilegeEscalation: false
       capabilities:
         add:
           ["IPC_LOCK"]
diff --git a/deployments/qat_dpdk_app/kustomization.yaml b/deployments/qat_dpdk_app/kustomization.yaml
new file mode 100644
index 00000000..f191f3aa
--- /dev/null
+++ b/deployments/qat_dpdk_app/kustomization.yaml
@@ -0,0 +1,2 @@
+bases:
+  - base
diff --git a/deployments/qat_plugin/base/intel-qat-kernel-plugin.yaml b/deployments/qat_plugin/base/intel-qat-kernel-plugin.yaml
index 2e748d71..4b6f8447 100644
--- a/deployments/qat_plugin/base/intel-qat-kernel-plugin.yaml
+++ b/deployments/qat_plugin/base/intel-qat-kernel-plugin.yaml
@@ -17,6 +17,7 @@ spec:
       - name: intel-qat-kernel-plugin
         securityContext:
           readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
           privileged: true
         image: intel/intel-qat-plugin:devel
         imagePullPolicy: IfNotPresent
diff --git a/deployments/qat_plugin/base/intel-qat-plugin.yaml b/deployments/qat_plugin/base/intel-qat-plugin.yaml
index 9ab528a5..b0dd099a 100644
--- a/deployments/qat_plugin/base/intel-qat-plugin.yaml
+++ b/deployments/qat_plugin/base/intel-qat-plugin.yaml
@@ -18,6 +18,7 @@ spec:
         image: intel/intel-qat-plugin:devel
         securityContext:
           readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
         imagePullPolicy: IfNotPresent
         volumeMounts:
         - name: devdir
diff --git a/deployments/sgx_admissionwebhook/kustomization.yaml b/deployments/sgx_admissionwebhook/kustomization.yaml
new file mode 100644
index 00000000..f191f3aa
--- /dev/null
+++ b/deployments/sgx_admissionwebhook/kustomization.yaml
@@ -0,0 +1,2 @@
+bases:
+  - base
diff --git a/deployments/sgx_admissionwebhook/manager/manager.yaml b/deployments/sgx_admissionwebhook/manager/manager.yaml
index 8079ab98..1d401e56 100644
--- a/deployments/sgx_admissionwebhook/manager/manager.yaml
+++ b/deployments/sgx_admissionwebhook/manager/manager.yaml
@@ -24,6 +24,7 @@ spec:
           runAsUser: 65532
           runAsGroup: 65532
           readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
         resources:
           limits:
             cpu: 100m
diff --git a/deployments/sgx_aesmd/base/intel-sgx-aesmd.yaml b/deployments/sgx_aesmd/base/intel-sgx-aesmd.yaml
index d88b42cc..b7daf142 100644
--- a/deployments/sgx_aesmd/base/intel-sgx-aesmd.yaml
+++ b/deployments/sgx_aesmd/base/intel-sgx-aesmd.yaml
@@ -21,6 +21,7 @@ spec:
         image: intel/sgx-aesmd-demo:devel
         securityContext:
           readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
         resources:
           limits:
             sgx.intel.com/epc: "1Mi"
diff --git a/deployments/sgx_enclave_apps/base/intelsgx-job.yaml b/deployments/sgx_enclave_apps/base/intelsgx-job.yaml
index 0ff0245c..ef9730e0 100644
--- a/deployments/sgx_enclave_apps/base/intelsgx-job.yaml
+++ b/deployments/sgx_enclave_apps/base/intelsgx-job.yaml
@@ -20,6 +20,7 @@ spec:
           command: ["/opt/intel/sgx-sample-app/sgx-sample-app"]
           securityContext:
             readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
             capabilities:
               add: ["IPC_LOCK"]
           resources:
diff --git a/deployments/sgx_enclave_apps/kustomization.yaml b/deployments/sgx_enclave_apps/kustomization.yaml
new file mode 100644
index 00000000..f191f3aa
--- /dev/null
+++ b/deployments/sgx_enclave_apps/kustomization.yaml
@@ -0,0 +1,2 @@
+bases:
+  - base
diff --git a/deployments/sgx_plugin/base/intel-sgx-plugin.yaml b/deployments/sgx_plugin/base/intel-sgx-plugin.yaml
index 35e6057c..1429c04f 100644
--- a/deployments/sgx_plugin/base/intel-sgx-plugin.yaml
+++ b/deployments/sgx_plugin/base/intel-sgx-plugin.yaml
@@ -18,6 +18,7 @@ spec:
         image: intel/intel-sgx-plugin:devel
         securityContext:
           readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
         imagePullPolicy: IfNotPresent
         volumeMounts:
         - name: kubeletsockets
diff --git a/deployments/sgx_plugin/overlays/epc-hook-initcontainer/add-epc-nfd-initcontainer.yaml b/deployments/sgx_plugin/overlays/epc-hook-initcontainer/add-epc-nfd-initcontainer.yaml
index aa12eaa2..385dfc0a 100644
--- a/deployments/sgx_plugin/overlays/epc-hook-initcontainer/add-epc-nfd-initcontainer.yaml
+++ b/deployments/sgx_plugin/overlays/epc-hook-initcontainer/add-epc-nfd-initcontainer.yaml
@@ -11,6 +11,7 @@ spec:
         imagePullPolicy: IfNotPresent
         securityContext:
           readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
         volumeMounts:
         - mountPath: /etc/kubernetes/node-feature-discovery/source.d/
           name: nfd-source-hooks
diff --git a/deployments/sgx_plugin/overlays/epc-nfd/add-epc-nfd-initcontainer.yaml b/deployments/sgx_plugin/overlays/epc-nfd/add-epc-nfd-initcontainer.yaml
index aa12eaa2..385dfc0a 100644
--- a/deployments/sgx_plugin/overlays/epc-nfd/add-epc-nfd-initcontainer.yaml
+++ b/deployments/sgx_plugin/overlays/epc-nfd/add-epc-nfd-initcontainer.yaml
@@ -11,6 +11,7 @@ spec:
         imagePullPolicy: IfNotPresent
         securityContext:
           readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
         volumeMounts:
         - mountPath: /etc/kubernetes/node-feature-discovery/source.d/
           name: nfd-source-hooks
diff --git a/deployments/vpu_plugin/base/intel-vpu-plugin.yaml b/deployments/vpu_plugin/base/intel-vpu-plugin.yaml
index ad5fae13..92af8cb9 100644
--- a/deployments/vpu_plugin/base/intel-vpu-plugin.yaml
+++ b/deployments/vpu_plugin/base/intel-vpu-plugin.yaml
@@ -24,6 +24,7 @@ spec:
         imagePullPolicy: IfNotPresent
         securityContext:
           readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
         volumeMounts:
         - name: devion
           mountPath: /dev/ion


Test patch:
diff --git a/pkg/controllers/dlb/controller_test.go b/pkg/controllers/dlb/controller_test.go
index 5d84ec6f..2d4b50ef 100644
--- a/pkg/controllers/dlb/controller_test.go
+++ b/pkg/controllers/dlb/controller_test.go
@@ -33,6 +33,7 @@ const appLabel = "intel-dlb-plugin"
 func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet {
 	devicePlugin := rawObj.(*devicepluginv1.DlbDevicePlugin)
 	yes := true
+	no := false
 
 	daemonSet := apps.DaemonSet{
 		TypeMeta: metav1.TypeMeta{
@@ -77,7 +78,8 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
 							Image:                  devicePlugin.Spec.Image,
 							ImagePullPolicy:        "IfNotPresent",
 							SecurityContext: &v1.SecurityContext{
-								ReadOnlyRootFilesystem: &yes,
+								ReadOnlyRootFilesystem:   &yes,
+								AllowPrivilegeEscalation: &no,
 							},
 							VolumeMounts: []v1.VolumeMount{
 								{
diff --git a/pkg/controllers/dsa/controller_test.go b/pkg/controllers/dsa/controller_test.go
index ff70c4a2..535fee1a 100644
--- a/pkg/controllers/dsa/controller_test.go
+++ b/pkg/controllers/dsa/controller_test.go
@@ -35,6 +35,7 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
 	devicePlugin := rawObj.(*devicepluginv1.DsaDevicePlugin)
 
 	yes := true
+	no := false
 	daemonSet := apps.DaemonSet{
 		TypeMeta: metav1.TypeMeta{
 			Kind:       "DaemonSet",
@@ -77,7 +78,8 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
 							Image:           devicePlugin.Spec.Image,
 							ImagePullPolicy: "IfNotPresent",
 							SecurityContext: &v1.SecurityContext{
-								ReadOnlyRootFilesystem: &yes,
+								ReadOnlyRootFilesystem:   &yes,
+								AllowPrivilegeEscalation: &no,
 							},
 							VolumeMounts: []v1.VolumeMount{
 								{
diff --git a/pkg/controllers/fpga/controller_test.go b/pkg/controllers/fpga/controller_test.go
index 8040dd99..806a2cef 100644
--- a/pkg/controllers/fpga/controller_test.go
+++ b/pkg/controllers/fpga/controller_test.go
@@ -35,6 +35,7 @@ const appLabel = "intel-fpga-plugin"
 func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet {
 	devicePlugin := rawObj.(*devicepluginv1.FpgaDevicePlugin)
 	yes := true
+	no := false
 	directoryOrCreate := v1.HostPathDirectoryOrCreate
 
 	return &apps.DaemonSet{
@@ -79,7 +80,8 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
 							ImagePullPolicy: "IfNotPresent",
 							Name:            appLabel,
 							SecurityContext: &v1.SecurityContext{
-								ReadOnlyRootFilesystem: &yes,
+								ReadOnlyRootFilesystem:   &yes,
+								AllowPrivilegeEscalation: &no,
 							},
 							TerminationMessagePath: "/tmp/termination-log",
 							VolumeMounts: []v1.VolumeMount{
@@ -106,7 +108,8 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
 							ImagePullPolicy: "IfNotPresent",
 							Name:            "intel-fpga-initcontainer",
 							SecurityContext: &v1.SecurityContext{
-								ReadOnlyRootFilesystem: &yes,
+								ReadOnlyRootFilesystem:   &yes,
+								AllowPrivilegeEscalation: &no,
 							},
 							VolumeMounts: []v1.VolumeMount{
 								{
diff --git a/pkg/controllers/gpu/controller_test.go b/pkg/controllers/gpu/controller_test.go
index c575f849..ba0a5e1e 100644
--- a/pkg/controllers/gpu/controller_test.go
+++ b/pkg/controllers/gpu/controller_test.go
@@ -36,6 +36,7 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
 	devicePlugin := rawObj.(*devicepluginv1.GpuDevicePlugin)
 
 	yes := true
+	no := false
 	daemonSet := apps.DaemonSet{
 		TypeMeta: metav1.TypeMeta{
 			Kind:       "DaemonSet",
@@ -78,7 +79,8 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
 							Image:           devicePlugin.Spec.Image,
 							ImagePullPolicy: "IfNotPresent",
 							SecurityContext: &v1.SecurityContext{
-								ReadOnlyRootFilesystem: &yes,
+								ReadOnlyRootFilesystem:   &yes,
+								AllowPrivilegeEscalation: &no,
 							},
 							VolumeMounts: []v1.VolumeMount{
 								{
diff --git a/pkg/controllers/qat/controller_test.go b/pkg/controllers/qat/controller_test.go
index ffebcaaf..10097820 100644
--- a/pkg/controllers/qat/controller_test.go
+++ b/pkg/controllers/qat/controller_test.go
@@ -35,6 +35,7 @@ const appLabel = "intel-qat-plugin"
 func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet {
 	devicePlugin := rawObj.(*devicepluginv1.QatDevicePlugin)
 	yes := true
+	no := false
 	pluginAnnotations := devicePlugin.ObjectMeta.DeepCopy().Annotations
 
 	return &apps.DaemonSet{
@@ -71,7 +72,8 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
 							Image:           devicePlugin.Spec.Image,
 							ImagePullPolicy: "IfNotPresent",
 							SecurityContext: &v1.SecurityContext{
-								ReadOnlyRootFilesystem: &yes,
+								ReadOnlyRootFilesystem:   &yes,
+								AllowPrivilegeEscalation: &no,
 							},
 							VolumeMounts: []v1.VolumeMount{
 								{
diff --git a/pkg/controllers/sgx/controller_test.go b/pkg/controllers/sgx/controller_test.go
index 1b4a315d..8b381fd2 100644
--- a/pkg/controllers/sgx/controller_test.go
+++ b/pkg/controllers/sgx/controller_test.go
@@ -36,6 +36,7 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
 	devicePlugin := rawObj.(*devicepluginv1.SgxDevicePlugin)
 
 	yes := true
+	no := false
 	charDevice := v1.HostPathCharDev
 	directoryOrCreate := v1.HostPathDirectoryOrCreate
 	daemonSet := apps.DaemonSet{
@@ -70,7 +71,8 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
 							Image:           devicePlugin.Spec.Image,
 							ImagePullPolicy: "IfNotPresent",
 							SecurityContext: &v1.SecurityContext{
-								ReadOnlyRootFilesystem: &yes,
+								ReadOnlyRootFilesystem:   &yes,
+								AllowPrivilegeEscalation: &no,
 							},
 							VolumeMounts: []v1.VolumeMount{
 								{
diff --git a/scripts/test-image-base-layer.sh b/scripts/test-image-base-layer.sh
deleted file mode 100755
index 6e16209c..00000000
--- a/scripts/test-image-base-layer.sh
+++ /dev/null
@@ -1,33 +0,0 @@
-#!/bin/sh -e
-#
-# Copyright 2022 Intel Corporation.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-
-die () {
-    echo "ERROR: $*"
-    exit 1
-}
-
-IMG=$1
-shift
-
-if [ "$1" = 'docker' ] || [ "$1" = 'buildah' ]; then
-    BUILDER=$1
-fi
-
-echo "Testing $IMG base layer"
-
-if [ -z "${BUILDER}" ] || [ "${BUILDER}" = 'docker' ] ; then
-    distroless_base=$(docker inspect --format='{{index .RootFS.Layers 0}}' "gcr.io/distroless/static") || die "failed to inspect gcr.io/distroless/static"
-    img_base=$(docker inspect --format='{{index .RootFS.Layers 0}}' "$IMG") || die "failed to inspect $IMG"
-elif [ "${BUILDER}" = 'buildah' ] ; then
-    distroless_base=$(buildah inspect --type image --format='{{index .OCIv1.RootFS.DiffIDs 0}}' "gcr.io/distroless/static") || die "failed to inspect gcr.io/distroless/static"
-    img_base=$(buildah inspect --type image --format='{{index .OCIv1.RootFS.DiffIDs 0}}' "$IMG") || die "failed to inspect $IMG"
-else
-    (>&2 echo "Unknown builder ${BUILDER}")
-    exit 1
-fi
-
-test "${distroless_base}" = "${img_base}" || die "$IMG base layer differs from gcr.io/distroless/static"