Back to Checks
kubernetes

Pod containers have no added Linux capabilities and include capability drops when capabilities are defined

core_minimize_containers_capabilities_assigned
Service: coreSeverity: high
OfficialBuilt-inVerified
Categories:container-security
Resource Type:Pod

Kubernetes Pods are inspected for container Linux capabilities. A finding occurs when any container sets capabilities in add or does not fully drop them (e.g., missing ALL), indicating capabilities are assigned instead of removed.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Retained or added Linux capabilities enable privilege escalation and container escape.

  • Confidentiality: packet capture and secret access
  • Integrity: filesystem mounts or process tampering
  • Availability: killing services or altering networking

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks core_minimize_containers_capabilities_assigned

Recommendation

Apply least privilege: drop ALL capabilities and avoid using add.

Only reintroduce a minimal capability when absolutely required, and isolate such pods via defense-in-depth: strict RBAC, seccomp RuntimeDefault, AppArmor, network policies, dedicated namespaces/nodes, and admission controls to enforce policy.

Remediation

CLI

kubectl patch deployment <DEPLOYMENT_NAME> -n <NAMESPACE> --type=merge -p '{"spec":{"template":{"spec":{"containers":[{"name":"<CONTAINER_NAME>","securityContext":{"capabilities":{"drop":["ALL"],"add":[]}}}]}}}}'

Terraform

resource "kubernetes_pod" "<example_resource_name>" {
  metadata { name = "<example_resource_name>" }
  spec {
    container {
      name  = "<example_resource_name>"
      image = "nginx:stable-alpine"
      security_context {
        capabilities {
          drop = ["ALL"] # Critical: drop all Linux capabilities to satisfy the check
          # No 'add' specified to ensure no capabilities are added
        }
      }
    }
  }
}

Other

1Open your Kubernetes UI (e.g., Kubernetes Dashboard or your cloud provider's console)
2Navigate to the workload (Deployment/StatefulSet/DaemonSet) that runs the failing Pod
3Click Edit YAML (or equivalent)
4For each affected container, set:
5- spec.template.spec.containers[].securityContext.capabilities.drop: ["ALL"]
6- Ensure spec.template.spec.containers[].securityContext.capabilities.add is removed or set to an empty list
7Save to apply and trigger a rollout

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.core.core_client import core_client


class core_minimize_containers_capabilities_assigned(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in core_client.pods.values():
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = (
                f"Pod {pod.name} without capabilities issues found."
            )

            for container in pod.containers.values():
                if (
                    container.security_context
                    and container.security_context["capabilities"]
                ):
                    if (
                        container.security_context["capabilities"]["add"]
                        or not container.security_context["capabilities"]["drop"]
                    ):
                        report.status = "FAIL"
                        report.status_extended = f"Pod {pod.name} has capabilities assigned or not all dropped in container {container.name}."
                        break

            findings.append(report)

        return findings

References