Potential local privilege escalation via environment variables misuse

Event Information

Meaning

This event indicates a potential security issue where an attacker may exploit environment variables to escalate their privileges within the Kubernetes cluster.
It is crucial to investigate the source of the environment variables and ensure that sensitive information or privileged access is not being misused.
To further investigate, you can list all pods in the cluster to identify the pod associated with the event using the following command: kubectl get pods.

Remediation

Create a Kubernetes Pod Security Policy to restrict the usage of environment variables in Pods:

apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: restrict-env-vars
spec:
  privileged: false
  allowPrivilegeEscalation: false
  requiredDropCapabilities:
    - ALL
  volumes:
    - '*'
  hostNetwork: false
  hostIPC: false
  hostPID: false
  runAsUser:
    rule: RunAsAny
  seLinux:
    rule: RunAsAny
  supplementalGroups:
    rule: RunAsAny
  fsGroup:
    rule: RunAsAny
  readOnlyRootFilesystem: false
  defaultAllowPrivilegeEscalation: false
  allowedHostPaths:
    - pathPrefix: "/etc"
      readOnly: false
  allowedFlexVolumes: []
  allowedUnsafeSysctls: []
  forbiddenSysctls:
    - '*'
  allowedProcMountTypes:
    - "Default"
  runAsGroup:
    rule: MustRunAs
    ranges:
      - min: 1
        max: 65535
  allowedCapabilities: []
  allowedProcMountTypes:
    - "Default"
  allowedUnsafeSysctls: []
  forbiddenSysctls:
    - "*"

Update the Pod definition to adhere to the Pod Security Policy created:

apiVersion: v1
kind: Pod
metadata:
  name: restricted-pod
spec:
  securityContext:
    seLinuxOptions:
      level: "s0:c123,c456"
  containers:
  - name: container
    image: nginx
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      runAsNonRoot: true
      runAsUser: 1000
      capabilities:
        drop:
          - ALL
    env:
      - name: ALLOWED_ENV_VAR
        value: "allowed"
  restartPolicy: Never

Apply the Pod Security Policy and update the Pod:

kubectl apply -f pod-security-policy.yaml
kubectl apply -f restricted-pod.yaml

​Event Information

​Meaning

​Remediation

Event Information

Meaning

Remediation