Repository navigation
Do you have any reason to run Lurker without this security params? #2920
Description
PodSecurity "restricted:latest":
unrestricted capabilities (containers "lurker" must set securityContext.capabilities.drop=["ALL"]),
"lurker" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
Todos:
Metadata
Metadata
Assignees
Type
Projects
- Status
Activity
[-]lurker priviledge[/-][+]Do you have any reason to run Lurker without this security params?[/+]Weltraumschaf commentedon Feb 25, 2025
Hi @kaz-33,
thanks for your question. Would you be so kind as to format the text correctly, because it is very difficult to understand exactly what your concern is.
kaz-33 commentedon Feb 25, 2025
done, this is a message from my cluster policy.
J12934 commentedon Feb 27, 2025
capabilities: The capabilities is allready set to drop
all. Its just written as lowercase, it should work the same, but apparently most tools only expect uppercase so would be good if this could be changed.seccompProfile: i'm still not a 100% certain if all clusters have the RuntimeDefault profile, so I wouldn't really want to hard code it as it stop the lurker from running on clusters at all. So if we'd add it, there should at least be a option to disable it if somebody has a cluster setup which doesn't support it. So far we left the lurker securityContentext not modifiable so this would be a bit harder to add.
The code which sets the lurker security context is here: https://github.com/secureCodeBox/secureCodeBox/blob/main/operator/controllers/execution/scans/scan_reconciler.go#L333