capabilities

Documentation

Index

• Constants
• Variables
• type Capabilities
  • func New(config Config) *Capabilities
  • func (a *Capabilities) Audit(resource k8stypes.Resource, _ []k8stypes.Resource) ([]*kubeaudit.AuditResult, error)
• type Config
  • func (config *Config) GetDropList() []string

Constants

const (
	// CapabilityAdded occurs when a capability is in the capability add list of a container's security context
	CapabilityAdded = "CapabilityAdded"
	// CapabilityNotDropped occurs when a capability that should be dropped is not in the capability drop list of a container's security context
	CapabilityNotDropped = "CapabilityNotDropped"
)

const Name = "capabilities"

Variables

var DefaultDropList = []string{
	"AUDIT_WRITE",
	"CHOWN",
	"DAC_OVERRIDE",
	"FOWNER",
	"FSETID",
	"KILL",
	"MKNOD",
	"NET_BIND_SERVICE",
	"NET_RAW",
	"SETFCAP",
	"SETGID",
	"SETPCAP",
	"SETUID",
	"SYS_CHROOT",
}

DefaultDropList is the list of capabilities that will be dropped if no drop list is specified https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities

Types

type Capabilities

type Capabilities struct {
	// contains filtered or unexported fields
}

Capabilities implements Auditable

func New

func New(config Config) *Capabilities

func (*Capabilities) Audit

func (a *Capabilities) Audit(resource k8stypes.Resource, _ []k8stypes.Resource) ([]*kubeaudit.AuditResult, error)

Audit checks that bad capabilities are dropped and no capabilities are added

type Config

type Config struct {
	DropList []string `yaml:"drop"`
}

func (*Config) GetDropList

func (config *Config) GetDropList() []string