Description

Detects when containers are configured with SysAdmin capabilities in Kubernetes manifests. This is a critical security risk since SysAdmin capabilities give containers powerful system-level privileges that could be used to escape container isolation and compromise the host system.

Detection Strategy

• Scans Kubernetes resource files (like Pod, Deployment, StatefulSet) for container security configurations

• Examines container spec sections within these resources looking for capability definitions

• Identifies when 'SYS_ADMIN' capability is added to containers through securityContext or capabilities fields

• Reports a vulnerability when containers are granted SysAdmin privileges, regardless of other security settings

Vulnerable code example

resource "kubernetes_pod" "example" {
  metadata {
    name = "vulnerable-pod"
  }
  spec {
    container {
      name  = "container"
      image = "nginx"...

✅ Secure code example

resource "kubernetes_pod" "example" {
  metadata {
    name = "secure-pod"
    labels = {
      app = "web"
    }
  }
  spec {...