rules:
- id: no-new-privileges
  patterns:
  - pattern-inside: |
      version: ...
      ...
      services:
        ...
  - pattern: |
      $SERVICE:
        ...
        image: ...
  - pattern-not: |
      $SERVICE:
        ...
        image: ...
        ...
        security_opt:
          - ...
          - no-new-privileges:true
          - ...
  - focus-metavariable: $SERVICE
  message: >-
    Service '$SERVICE' allows for privilege escalation via setuid or setgid
    binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this.
  metadata:
    cwe:
    - 'CWE-732: Incorrect Permission Assignment for Critical Resource'
    owasp:
    - A05:2021 - Security Misconfiguration
    - A06:2017 - Security Misconfiguration
    references:
    - https://raesene.github.io/blog/2019/06/01/docker-capabilities-and-no-new-privs/
    - https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt
    - https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag
    category: security
    technology:
    - docker-compose
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    confidence: LOW
  languages: [yaml]
  severity: WARNING