Skip to main content

☑️ Prevent SELinux containers from setting a role

SELinux defines access controls for the applications, processes, and files on a system. SELinux uses security policies, which are a set of rules that tell SELinux what can or can't be accessed, to enforce the access allowed by a policy.
SELinux options can be used to escalate privileges and should not be allowed.

Targeted objects by this rule (types of kind): Deployment / Pod / DaemonSet / StatefulSet / ReplicaSet / CronJob / Job

Complexity: easy (What does this mean?)

Policy as code identifier: EKS_INVALID_SELINUXOPTIONS_ROLE_VALUE


This rule will fail

If an SELinux role is set:

spec:
containers:
- securityContext:
seLinuxOptions:
role: usr

Rule output in the CLI

$ datree test *.yaml

>> File: failExample.yaml
❌ Prevent SELinux containers from setting a role [1 occurrence]
💡 Invalid key `role` - refrain from setting this key to prevent potential access to the host filesystem

How to fix this failure

spec:
containers:
- securityContext:
seLinuxOptions:
type: container_kvm_t

Read more