rules:
- id: exposing-docker-socket-hostpath
  patterns:
  - pattern-inside: |
      volumes:
        ...
  - pattern: |
      hostPath:
        ...
        path: /var/run/docker.sock
  message: >-
    Exposing host's Docker socket to containers via a volume. The owner of this
    socket is root. Giving someone access to it is equivalent to giving
    unrestricted root access to your host. Remove 'docker.sock' from hostpath to
    prevent this.
  metadata:
    cwe:
    - 'CWE-250: Execution with Unnecessary Privileges'
    references:
    - https://kubernetes.io/docs/concepts/storage/volumes/#hostpath
    - https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems
    - https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
    - https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-1-do-not-expose-the-docker-daemon-socket-even-to-the-containers
    category: security
    technology:
    - kubernetes
    subcategory:
    - vuln
    likelihood: LOW
    impact: HIGH
    confidence: MEDIUM
  languages: [yaml]
  severity: WARNING