rules:
- id: selinux-separation-disabled
  patterns:
  - pattern-inside: |
      version: ...
      ...
      services:
        ...
  - pattern: |
      $SERVICE:
        ...
        image: ...
        ...
        security_opt:
          - ...
          - label:disable
  message: >-
    Service '$SERVICE' is explicitly disabling SELinux separation. This runs the
    service as an unconfined type. Remove 'label:disable' to prevent this.
  metadata:
    cwe:
    - 'CWE-284: Improper Access Control'
    references:
    - https://www.projectatomic.io/blog/2016/03/dwalsh_selinux_containers/
    - https://docs.docker.com/engine/reference/run/#security-configuration
    category: security
    technology:
    - docker-compose
    owasp:
    - A05:2017 - Broken Access Control
    - A01:2021 - Broken Access Control
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    confidence: LOW
  languages: [yaml]
  severity: WARNING