rules:
- id: run-as-non-root-container-level
  patterns:
  - pattern-inside: |
      spec:
        ...
        containers:
          ...
        ...
  # No runAsNonRoot in Security Context at pod level
  - pattern-not-inside: |
      spec:
        ...
        securityContext:
          ...
          runAsNonRoot: $VAL
        ...
  # Containers defined
  - pattern-inside: |
      spec:
        ...
        containers:
          ...
  # At least one container in this pod has defined runAsNonRoot
  # So a decision is made to secure at container level
  - pattern-inside: |
      spec:
        ...
        containers:
          ...
          - name: $NAME
            image: ...
            ...
            securityContext:
              ...
              runAsNonRoot: $VALUE
  # Capture container security Context
  - pattern: |
          - name: $CONTAINER
            image: ...
            ...
            $SC:
              ...
  - metavariable-regex:
      metavariable: $SC
      regex: ^(securityContext)$
  # But missing runAsNonRoot
  - pattern-not: |
          - name: $CONTAINER
            image: ...
            ...
            securityContext:
              ...
              runAsNonRoot: $VALUE
  - focus-metavariable: $SC
  fix: |
    $SC:
      runAsNonRoot: true #
  message: >-
    When running containers in Kubernetes, it's important to ensure that they
    are properly secured to prevent privilege escalation attacks.
    One potential vulnerability is when a container is allowed to run
    applications as the root user, which could allow an attacker to gain
    access to sensitive resources. To mitigate this risk, it's recommended to
    add a `securityContext` to the container, with the parameter `runAsNonRoot`
    set to `true`. This will ensure that the container runs as a non-root user,
    limiting the damage that could be caused by any potential attacks. By
    adding a `securityContext` to the container in your Kubernetes pod, you can
    help to ensure that your containerized applications are more secure and
    less vulnerable to privilege escalation attacks.
  metadata:
    references:
    - https://kubernetes.io/blog/2016/08/security-best-practices-kubernetes-deployment/
    - https://kubernetes.io/docs/concepts/policy/pod-security-policy/
    - https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-2-set-a-user
    category: security
    cwe:
    - 'CWE-250: Execution with Unnecessary Privileges'
    owasp:
    - A05:2021 - Security Misconfiguration
    - A06:2017 - Security Misconfiguration
    technology:
    - kubernetes
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
  languages:
  - yaml
  severity: INFO