Back to Checks
kubernetes

Pod containers do not have the NET_RAW capability

core_minimize_net_raw_capability_admission
Service: coreSeverity: high
OfficialBuilt-inVerified
Categories:container-security
Resource Type:Pod

Kubernetes pods where any container's security context adds the NET_RAW Linux capability are identified.

The inspection evaluates container securityContext.capabilities.add entries to detect explicit requests for NET_RAW.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Granting NET_RAW enables raw sockets for packet crafting and sniffing, undermining confidentiality and integrity. Attackers can run ARP/DNS spoofing, pivot or scan inside the cluster, bypass service isolation, exfiltrate data, and impact availability through network abuse.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks core_minimize_net_raw_capability_admission

Recommendation

Apply least privilege: avoid adding NET_RAW and drop unnecessary Linux capabilities by default. Use cluster-wide admission policies to block requests for NET_RAW. When strictly required, isolate the workload, restrict egress with network controls, and audit capability use as part of defense in depth.

Remediation

Terraform

resource "kubernetes_pod" "<example_resource_name>" {
  metadata { name = "<example_resource_name>" }
  spec {
    container {
      name  = "<example_resource_name>"
      image = "nginx"
      security_context {
        capabilities {
          drop = ["NET_RAW"] # Critical: ensures the container is not granted NET_RAW
        }
      }
    }
  }
}

Other

1Identify the affected workload (Deployment/StatefulSet/Pod) and open its spec for edit (e.g., kubectl edit deployment <example_resource_name>)
2In each container under: spec.template.spec.containers[].securityContext.capabilities.add, remove the entry NET_RAW (or remove the entire add field if it only contains NET_RAW)
3Save the changes to trigger a rollout (for Pod manifests, kubectl apply -f <file.yaml>)
4Recreate any standalone Pods if needed so the updated spec takes effect

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.core.core_client import core_client


class core_minimize_net_raw_capability_admission(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in core_client.pods.values():
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = f"Pod {pod.name} does not have NET_RAW capability."
            for container in pod.containers.values():
                security_context = getattr(container, "security_context", None)
                if security_context:
                    capabilities = getattr(security_context, "capabilities", None)
                    if capabilities:
                        add_capabilities = getattr(capabilities, "add", [])
                        if add_capabilities and "NET_RAW" in add_capabilities:
                            report.status = "FAIL"
                            report.status_extended = f"Pod {pod.name} has NET_RAW capability in container {container.name}."
                            break

            findings.append(report)

        return findings

References