rules:
- id: hostpid-pod
  patterns:
  - pattern-inside: |
      spec:
        ...
  - pattern: |
      hostPID: true
  message: >-
    Pod is sharing the host process ID namespace. When paired with ptrace
    this can be used to escalate privileges outside of the container. Remove
    the 'hostPID' key to disable this functionality.
  metadata:
    cwe:
    - 'CWE-269: Improper Privilege Management'
    references:
    - https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces
    category: security
    technology:
    - kubernetes
    owasp:
    - A04:2021 - Insecure Design
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
  languages: [yaml]
  severity: WARNING