rspec/rules/S6433/kubernetes/rule.adoc

Mounting sensitive file system paths can lead to information disclosure and compromise of the host systems.

System paths can contain sensitive information like configuration files or cache files.
Those might be used by attackers to expand permissions or to collect information for further attacks.
System paths can also contain binaries and scripts that might be executed by the host system periodically.
A compromised or rogue container with access to sensitive files could endanger the integrity of the whole Kubernetes cluster.


== Ask Yourself Whether

* The mounted file path contains sensitive information.
* The mounted file path contains configuration files or executables that are writable.
* The Pod is untrusted or might contain vulnerabilities.

There is a risk if you answered yes to any of those questions.


== Recommended Secure Coding Practices

It is recommended to avoid mounting sensitive system file paths into containers.
If it is necessary to mount such a path due to the architecture, the least privileges should be given, for instance by making the mount read-only to prevent unwanted modifications.


== Sensitive Code Example
[source,yaml]
----
apiVersion: v1
kind: Pod
metadata:
  name: test
spec:
  containers:
  - image: k8s.gcr.io/test-webserver
    name: test-container
    volumeMounts:
    - mountPath: /data
      name: test-volume
  volumes:
  - name: test-volume
    hostPath:
      path: /etc # Sensitive
----

== Compliant Solution
[source,yaml]
----
apiVersion: v1
kind: Pod
metadata:
  name: test
spec:
  containers:
  - image: k8s.gcr.io/test-webserver
    name: test-container
    volumeMounts:
    - mountPath: /data
      name: test-volume
  volumes:
  - name: test-volume
    hostPath:
      path: /mnt/nfs
----

== See

* https://kubernetes.io/docs/concepts/storage/volumes/#hostpath[Kubernetes Documentation] - Volumes
* CWE - https://cwe.mitre.org/data/definitions/284[CWE-668 - Exposure of Resource to Wrong Sphere]


ifdef::env-github,rspecator-view[]

'''
== Implementation Specification
(visible only on this page)

=== Message

Make sure mounting the file system path is safe here.


=== Highlighting

* Highlight the whole path if not empty.


endif::env-github,rspecator-view[]