Detections
Analytics

4.6.2 Rely on Autopilot RuntimeDefault seccomp; custom profiles are unsupported

Information

GKE Autopilot automatically applies the RuntimeDefault seccomp profile to workload Pods, so custom seccomp profile configuration is not required for normal workloads. Custom Localhost seccomp profiles are not supported in Autopilot because GKE manages the nodes, and GKE Sandbox Pods use sandbox isolation as the security boundary instead of Pod specified seccomp rules.

Seccomp reduces container risk by limiting the Linux system calls that container processes can make to the node kernel. In Autopilot, GKE applies the containerd default seccomp profile automatically, which provides baseline hardening while maintaining compatibility with most workloads. The default profile blocks selected syscalls that can be used to bypass container isolation or gain privileged access to the node.

Because Autopilot nodes are managed by GKE, custom node level seccomp profiles are not a supported hardening path. Workloads should rely on the Autopilot applied RuntimeDefault profile unless there is a documented exception, such as a workload that explicitly requires Unconfined or a GKE Sandbox workload where seccomp rules in the Pod manifest are ignored.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

For GKE Autopilot workloads, remove unsupported custom Localhost seccomp profile settings and rely on the automatically applied RuntimeDefault profile. Do not attempt to install or manage custom seccomp profiles on Autopilot nodes because GKE manages the node environment.

If a workload specifies Unconfined, validate and document the requirement, then remove the override where possible so the workload uses the Autopilot default seccomp protection. For GKE Sandbox workloads, treat the sandbox as the security boundary because seccomp rules specified in the Pod manifest are ignored.

Impact:

Applications that attempt restricted syscalls might fail to start or might experience runtime errors when the Autopilot applied seccomp profile blocks those syscalls. Workloads that require custom Localhost profiles must be redesigned for Autopilot or run in a platform that supports custom seccomp profile management. Using Unconfined reduces syscall filtering and should be limited to documented exceptions.

See Also

https://workbench.cisecurity.org/benchmarks/24958

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|5.2

Plugin: GCP

Control ID: 1a22cf4eba3280e413f37b7a54ad3ffd744bae1eb5cd8f6abfe57c256feca975