Description

Detects when Kubernetes container configurations grant dangerous SYS_ADMIN capabilities. Containers with SYS_ADMIN privileges can perform privileged system operations, effectively having root-level access which creates significant security risks in a Kubernetes cluster.

Detection Strategy

• Scans Kubernetes resource files (like Pod or Deployment specs) for container security context definitions

• Examines the 'capabilities.add' field in container specifications

• Alerts if 'SYS_ADMIN' capability (case-insensitive) is added to any container

• Reports each container configuration that includes this dangerous capability

Vulnerable code example

apiVersion: v1
kind: Pod
metadata:
  name: vulnerable-pod
spec:
  containers:
    - name: container-1
      image: nginx...

✅ Secure code example

apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
  labels:
    app: web
spec:
  automountServiceAccountToken: false  # Prevent automatic mounting of service account tokens...