ksv106 "container should drop all" false positive

[huornlmj]

Checklist

• I've read the documentation regarding wrong detection.
• I've confirmed that a security advisory in data sources was correct.
  • Run Trivy with -f json that shows data sources and make sure that the security advisory is correct.

Description

$ trivy config FILE.yaml on a K8s deployment file throws the following error despite a capabilities drop all directive being present.

LOW: container should drop all
═══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
Containers must drop ALL capabilities, and are only permitted to add back the NET_BIND_SERVICE capability.

See https://avd.aquasec.com/misconfig/ksv106
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 FILE.yaml:20-41
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
  20 ┌       - name: REDACTEDext
  21 │         command:
  22 │         - "/extender"
  23 │         - "--cert=/REDACTED/cert/tls.crt"
  24 │         - "--key=/REDACTED/cert/tls.key"
  25 │         - "--cacert=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
  26 │         - "--v=4"
  27 │         image: REDACTED
  28 └         imagePullPolicy: IfNotPresent
  ..
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

FILE.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: REDACTED
  namespace: default 
  labels:
    app: REDACTED
spec:
  replicas: 1
  selector:
    matchLabels:
      app: REDACTED
  template:
    metadata:
      labels:
        app: REDACTED
    spec:
      serviceAccountName: REDACTED-service-account
      containers:
      - name: REDACTEDext
        command:
        - "/extender"
        - "--cert=/REDACTED/cert/tls.crt"
        - "--key=/REDACTED/cert/tls.key"
        - "--cacert=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
        - "--v=4"
        image: REDACTED
        imagePullPolicy: IfNotPresent
        securityContext:
          capabilities:
            drop:
              - all
          readOnlyRootFilesystem: true
          runAsNonRoot: true
          runAsUser: 10001
          allowPrivilegeEscalation: false
          seccompProfile:
            type: RuntimeDefault
...

JSON Output of run with -debug:

$ trivy config deploy/FILE.yaml --debug
2022-12-02T13:12:50.504Z        DEBUG   Severities: ["UNKNOWN" "LOW" "MEDIUM" "HIGH" "CRITICAL"]
2022-12-02T13:12:50.505Z        DEBUG   cache dir:  /home/user/.cache/trivy
2022-12-02T13:12:50.505Z        INFO    Misconfiguration scanning is enabled
2022-12-02T13:12:51.458Z        DEBUG   OS is not detected.
2022-12-02T13:12:51.458Z        INFO    Detected config files: 1
2022-12-02T13:12:51.458Z        DEBUG   Scanned config file: FILE.yaml

Output of trivy -v:

$ trivy -v
Version: 0.34.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2022-12-02 12:08:11.606948816 +0000 UTC
  NextUpdate: 2022-12-02 18:08:11.606948416 +0000 UTC
  DownloadedAt: 2022-12-02 12:36:13.855492637 +0000 UTC

Additional details (base image name, container registry info...):

[emilkje]

This seems to be related to case sensitivity. I got rid of the false positive with

securityContext:
  capabilities:
    drop:
       - ALL

[knqyf263]

@giorod3 Would you take a look?

[simar7]

Opening and tracking this as a bug: #4604 as it seems to be case sensitive, all vs ALL

[joebowbeer]

@simar7 see kubernetes/pod-security-admission#11 (comment)

In addition to not matching the spec, which is a problem in and of itself, the most likely problem that might arise in practice is that trivy will NOT catch this in CI/CD but a compliant admission controller WILL reject it when it is applied to the cluster.

[simar7]

Hi can you please open a new discussion in the Trivy repo so we can track it collectively?

cc @chen-keinan @itaysk

[joebowbeer]

Done: #6474