rules:
- id: allow-privilege-escalation-true
  patterns:
  - pattern-inside: |
      containers:
        ...
  - pattern-inside: |
      - name: $CONTAINER
        ...
  - pattern-inside: |
      image: ...
      ...
  - pattern-inside: |
      securityContext:
        ...
  - pattern: |
      allowPrivilegeEscalation: $TRUE
  - metavariable-pattern:
      metavariable: $TRUE
      pattern: |
        true
  - focus-metavariable: $TRUE
  fix: |
    false
  message: >-
    In Kubernetes, each pod runs in its own isolated environment with its own 
    set of security policies. However, certain container images may contain 
    `setuid` or `setgid` binaries that could allow an attacker to perform 
    privilege escalation and gain access to sensitive resources. To mitigate 
    this risk, it's recommended to add a `securityContext` to the container in 
    the pod, with the parameter `allowPrivilegeEscalation` set to `false`. 
    This will prevent the container from running any privileged processes and 
    limit the impact of any potential attacks. 
    In the container `$CONTAINER` this parameter is set to `true` which makes
    this container much more vulnerable to privelege escalation attacks.
  metadata:
    cwe:
    - 'CWE-732: Incorrect Permission Assignment for Critical Resource'
    owasp:
    - A05:2021 - Security Misconfiguration
    - A06:2017 - Security Misconfiguration
    references:
    - https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation
    - https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
    - https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt
    - https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag
    category: security
    technology:
    - kubernetes
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
  languages: [yaml]
  severity: WARNING