Description

Detects Kubernetes containers with missing or unsafe seccomp profiles. Running containers without seccomp profiles or with "unconfined" profiles removes important system call restrictions, potentially allowing containers to make dangerous system calls that could compromise host security.

Detection Strategy

• Examines Kubernetes container specifications in YAML/JSON configurations

• Reports a vulnerability if a container has no securityContext configuration

• Reports a vulnerability if securityContext exists but has no seccomp type defined

• Reports a vulnerability if seccomp profile type is explicitly set to 'unconfined'

• Checks both pod-level and container-level securityContext configurations

Vulnerable code example

apiVersion: batch/v1
kind: CronJob
metadata:
  name: demo-job
spec:
  schedule: "0 * * * *"
  jobTemplate:
    spec:...

✅ Secure code example

apiVersion: batch/v1
kind: CronJob
metadata:
  name: demo-job
spec:
  schedule: "0 * * * *"
  jobTemplate:
    spec:...