87 lines
2.2 KiB
Plaintext
87 lines
2.2 KiB
Plaintext
Mounting sensitive file system paths can lead to information disclosure and compromise of the host systems.
|
|
|
|
System paths can contain sensitive information like configuration files or cache files.
|
|
Those might be used by attackers to expand permissions or to collect information for further attacks.
|
|
System paths can also contain binaries and scripts that might be executed by the host system periodically.
|
|
A compromised or rogue container with access to sensitive files could endanger the integrity of the whole Kubernetes cluster.
|
|
|
|
|
|
== Ask Yourself Whether
|
|
|
|
* The mounted file path contains sensitive information.
|
|
* The mounted file path contains configuration files or executables that are writable.
|
|
* The Pod is untrusted or might contain vulnerabilities.
|
|
|
|
There is a risk if you answered yes to any of those questions.
|
|
|
|
|
|
== Recommended Secure Coding Practices
|
|
|
|
It is recommended to avoid mounting sensitive system file paths into containers.
|
|
If it is necessary to mount such a path due to the architecture, the least privileges should be given, for instance by making the mount read-only to prevent unwanted modifications.
|
|
|
|
|
|
== Sensitive Code Example
|
|
[source,yaml]
|
|
----
|
|
apiVersion: v1
|
|
kind: Pod
|
|
metadata:
|
|
name: test
|
|
spec:
|
|
containers:
|
|
- image: k8s.gcr.io/test-webserver
|
|
name: test-container
|
|
volumeMounts:
|
|
- mountPath: /data
|
|
name: test-volume
|
|
volumes:
|
|
- name: test-volume
|
|
hostPath:
|
|
path: /etc # Sensitive
|
|
----
|
|
|
|
== Compliant Solution
|
|
[source,yaml]
|
|
----
|
|
apiVersion: v1
|
|
kind: Pod
|
|
metadata:
|
|
name: test
|
|
spec:
|
|
containers:
|
|
- image: k8s.gcr.io/test-webserver
|
|
name: test-container
|
|
volumeMounts:
|
|
- mountPath: /data
|
|
name: test-volume
|
|
volumes:
|
|
- name: test-volume
|
|
hostPath:
|
|
path: /mnt/nfs
|
|
----
|
|
|
|
== See
|
|
|
|
* https://kubernetes.io/docs/concepts/storage/volumes/#hostpath[Kubernetes Documentation] - Volumes
|
|
* CWE - https://cwe.mitre.org/data/definitions/284[CWE-668 - Exposure of Resource to Wrong Sphere]
|
|
|
|
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
=== Message
|
|
|
|
Make sure mounting the file system path is safe here.
|
|
|
|
|
|
=== Highlighting
|
|
|
|
* Highlight the whole path if not empty.
|
|
|
|
|
|
endif::env-github,rspecator-view[]
|