Execution: GKE launch excessively capable container

This document describes a threat finding type in Security Command Center. Threat findings are generated by threat detectors when they detect a potential threat in your cloud resources. For a full list of available threat findings, see Threat findings index.

Overview

Someone deployed a container with one or more of the following capabilities in a GKE cluster that has an elevated security context:

  • CAP_SYS_MODULE
  • CAP_SYS_RAWIO
  • CAP_SYS_PTRACE
  • CAP_SYS_BOOT
  • CAP_DAC_READ_SEARCH
  • CAP_NET_ADMIN
  • CAP_BPF

These capabilities have been used before to escape from containers and should be provisioned with caution.

How to respond

The following response plan might be appropriate for this finding, but might also impact operations. Carefully evaluate the information you gather in your investigation to determine the best way to resolve findings.

To respond to this finding, do the following:

  1. Review the container's security context in its Pod definition. Identify any capabilities that are not strictly necessary for its function.
  2. Remove or reduce excessive capabilities whenever possible. Use the principle of least privilege.

What's next