rules:
- id: allow-privilege-escalation-no-securitycontext
  patterns:
  - pattern-inside: |
      containers:
        ...
  - pattern-inside: |
      - $NAME: $CONTAINER
        ...
  - pattern: |
      image: ...
      ...
  - pattern-not: |
      image: ...
      ...
      securityContext:
        ...
  - metavariable-regex:
      metavariable: $NAME
      regex: "name"
  - focus-metavariable: $NAME
  fix: |
    securityContext:
      allowPrivilegeEscalation: false
    $NAME
  message: >-
    In Kubernetes, each pod runs in its own isolated environment with its own
    set of security policies. However, certain container images may contain
    `setuid` or `setgid` binaries that could allow an attacker to perform
    privilege escalation and gain access to sensitive resources. To mitigate
    this risk, it's recommended to add a `securityContext` to the container in
    the pod, with the parameter `allowPrivilegeEscalation` set to `false`.
    This will prevent the container from running any privileged processes and
    limit the impact of any potential attacks.
    By adding a `securityContext` to your Kubernetes pod, you can help to
    ensure that your containerized applications are more secure and less
    vulnerable to privilege escalation attacks.
  metadata:
    cwe:
    - 'CWE-732: Incorrect Permission Assignment for Critical Resource'
    owasp:
    - A05:2021 - Security Misconfiguration
    - A06:2017 - Security Misconfiguration
    references:
    - https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation
    - https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
    - https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt
    - https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag
    category: security
    technology:
    - kubernetes
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
  languages: [yaml]
  severity: WARNING