SELinux defines access controls for the applications, processes, and files on a system. SELinux uses security policies, which are a set of rules that tell SELinux what can or can't be accessed, to enforce the access allowed by a policy.
SELinux options can be used to escalate privileges and should not be allowed.
Targeted objects by this rule (types of
kind): Deployment / Pod / DaemonSet / StatefulSet / ReplicaSet / CronJob / Job
Complexity: medium (What does this mean?)
Policy as code identifier: EKS_INVALID_SELINUXOPTIONS_TYPE_VALUE
This rule will fail
type is set to any value other than
Rule output in the CLI
$ datree test *.yaml
>> File: failExample.yaml
❌ Prevent SELinux containers from running with unnecessary privileges [1 occurrence]
💡 Invalid value for key `type` - set to a predefined type to prevent unnecessary privileges
How to fix this failure