Description

Detects Kubernetes containers whose seccomp profile is explicitly set to unconfined. Running containers with "unconfined" profiles removes important system call restrictions, potentially allowing containers to make dangerous system calls that could compromise host security.

Detection Strategy

• Examines Kubernetes container specifications in YAML/JSON configurations

• Reports a vulnerability if seccomp profile type is explicitly set to 'unconfined'

• Checks both pod-level and container-level securityContext configurations

Vulnerable code example

apiVersion: batch/v1
kind: CronJob
metadata:
  name: demo-job
spec:
  schedule: "0 * * * *"
  jobTemplate:
    spec:...

✅ Secure code example

apiVersion: batch/v1
kind: CronJob
metadata:
  name: demo-job
spec:
  schedule: "0 * * * *"
  jobTemplate:
    spec:...