add check for privileged containers (rule 106)

tenable · Jan 15, 2021 · fe0c724 · fe0c724
1 parent eeab9fe
commit fe0c724
Show file tree

Hide file tree

Showing 2 changed files with 25 additions and 0 deletions.
diff --git a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-H-0106.json b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-H-0106.json
@@ -0,0 +1,14 @@
+{
+    "name": "priviledgedContainersEnabled",
+    "file": "priviledgedContainersEnabled.rego",
+    "template_args": {
+        "name": "priviledgedContainersEnabled",
+        "prefix": "",
+        "suffix": ""
+    },
+    "severity": "HIGH",
+    "description": "Minimize the admission of privileged containers",
+    "reference_id": "AC-K8-IA-PO-H-0106",
+    "category": "Identity and Access Management",
+    "version": 1
+}
diff --git a/pkg/policies/opa/rego/k8s/kubernetes_pod/priviledgedContainersEnabled.rego b/pkg/policies/opa/rego/k8s/kubernetes_pod/priviledgedContainersEnabled.rego
@@ -0,0 +1,11 @@
+package accurics
+
+{{.prefix}}{{.name}}{{.suffix}}[pod.id] {
+	pod := input.kubernetes_pod[_]
+    pod.config.spec.privileged == true
+}
+
+{{.prefix}}{{.name}}{{.suffix}}[pod.id] {
+	pod := input.kubernetes_pod_security_policy[_]
+    pod.config.spec.privileged == true
+}