Mounting sensitive file system paths can lead to information disclosure and compromise of the host systems.
System paths can contain sensitive information like configuration files or cache files. Those might be used by attackers to expand permissions or
to collect information for further attacks. System paths can also contain binaries and scripts that might be executed by the host system periodically.
A compromised or rogue container with access to sensitive files could endanger the integrity of the whole Kubernetes cluster.
Ask Yourself Whether
- The mounted file path contains sensitive information.
- The mounted file path contains configuration files or executables that are writable.
- The Pod is untrusted or might contain vulnerabilities.
There is a risk if you answered yes to any of those questions.
Recommended Secure Coding Practices
It is recommended to avoid mounting sensitive system file paths into containers. If it is necessary to mount such a path due to the architecture,
the least privileges should be given, for instance by making the mount read-only to prevent unwanted modifications.
Sensitive Code Example
apiVersion: v1
kind: Pod
metadata:
name: test
spec:
containers:
- image: k8s.gcr.io/test-webserver
name: test-container
volumeMounts:
- mountPath: /data
name: test-volume
volumes:
- name: test-volume
hostPath:
path: /etc # Sensitive
Compliant Solution
apiVersion: v1
kind: Pod
metadata:
name: test
spec:
containers:
- image: k8s.gcr.io/test-webserver
name: test-container
volumeMounts:
- mountPath: /data
name: test-volume
volumes:
- name: test-volume
hostPath:
path: /mnt/nfs
See
