Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Forbid container privilege escalations #981

Open
wants to merge 5 commits into
base: master
Choose a base branch
from

Conversation

georgibaltiev
Copy link

How to categorize this PR?

/area security
/area compliance
/kind enhancement
/platform openstack

What this PR does / why we need it:
This PR sets the securityContext.allowPrivilegeEscalation field to false for every container, which does not have securityContext.Privileged set to true or one of CAP_SYS_ADMIN/SYS_ADMIN capabilities added.

Which issue(s) this PR fixes:
Part of gardener/gardener#11139

Special notes for your reviewer:
cc @AleksandarSavchev

Release note:

Containers, which do not require privilege escalations, now forbid privilege escalations explicitly.

@gardener-robot-ci-1 gardener-robot-ci-1 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Feb 14, 2025
@gardener-robot gardener-robot added the needs/review Needs review label Feb 14, 2025
@gardener-robot-ci-1 gardener-robot-ci-1 added needs/ok-to-test Needs approval for testing (check PR in detail before setting this label because PR is run on CI/CD) and removed reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) labels Feb 14, 2025
@georgibaltiev georgibaltiev force-pushed the forbid-container-privilege-escalations branch from a318014 to 612354b Compare February 20, 2025 12:41
@gardener-robot gardener-robot added the size/s Size of pull request is small (see gardener-robot robot/bots/size.py) label Feb 20, 2025
@gardener-robot-ci-1 gardener-robot-ci-1 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Feb 20, 2025
@gardener-robot-ci-2 gardener-robot-ci-2 removed the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Feb 20, 2025
@georgibaltiev georgibaltiev force-pushed the forbid-container-privilege-escalations branch from 612354b to 2c4d986 Compare February 21, 2025 13:01
@gardener-robot-ci-1 gardener-robot-ci-1 added reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) and removed reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) labels Feb 21, 2025
@gardener-robot-ci-2 gardener-robot-ci-2 added reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) and removed reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) labels Feb 24, 2025
@gardener-robot-ci-2 gardener-robot-ci-2 added reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) and removed reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) labels Feb 24, 2025
@georgibaltiev georgibaltiev marked this pull request as ready for review February 24, 2025 18:09
@georgibaltiev georgibaltiev requested review from a team as code owners February 24, 2025 18:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
needs/ok-to-test Needs approval for testing (check PR in detail before setting this label because PR is run on CI/CD) needs/review Needs review size/s Size of pull request is small (see gardener-robot robot/bots/size.py)
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants