Detections
Analytics

5.2.7 Minimize the admission of root containers

Information

Do not generally permit containers to be run as the root user.

Containers may run as any Linux user. Containers which run as the root user, whilst constrained by Container Runtime security features still have an escalated likelihood of container breakout.

There are two approaches to mitigating this risk:

 -

Run as a non-root user. Configure containers to run as a defined non-UID 0 user by setting MustRunAsNonRoot or MustRunAs with a range of UIDs not including 0 in an admission control policy.

 -

Use user namespaces. From Kubernetes v1.36, pods may set hostUsers: false to enable Linux user namespaces. This maps UID 0 inside the container to an unprivileged user on the host, so that even if a container runs as root internally, it does not have root privileges on the host. This mitigates the severity of container breakout vulnerabilities and neutralises host-level capabilities.

Either approach is a valid way to prevent containers from running as the real root user on the host. Where workloads require running as root inside the container, user namespaces are the preferred mitigation. Ideally, both controls should be used together where possible.

There should be at least one admission control policy defined which either does not permit root containers or requires the use of user namespaces. If you need to run root containers without user namespaces, this should be defined in a separate policy and you should carefully check to ensure that only limited service accounts and users are given permission to use that policy.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Create a policy for each namespace in the cluster, ensuring that either MustRunAsNonRoot or MustRunAs with the range of UIDs not including 0, is set. Alternatively, require pods to set hostUsers: false to enable user namespaces. User namespaces require Linux kernel 6.3+ and a compatible container runtime (containerd 2.0+ or CRI-O 1.25+).

Impact:

Pods with containers which run as the root user will not be permitted.

See Also

https://workbench.cisecurity.org/benchmarks/26886

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(2), 800-53|AC-6(5), CSCv7|4

Plugin: Unix

Control ID: 8a0c7e797100050127514a9e4ed361b4f34a234f783ffc4271f93af4ce750408