Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Dex is allowing Privilege escalation and run as Root #2730

Open
riqueps opened this issue Nov 30, 2023 · 0 comments
Open

Dex is allowing Privilege escalation and run as Root #2730

riqueps opened this issue Nov 30, 2023 · 0 comments
Labels
area/security Issue is about security failures, weaknesses, or has security implications kind/bug Something isn't working kind/enhancement New feature or request

Comments

@riqueps
Copy link

riqueps commented Nov 30, 2023

Is your feature request related to a problem? Please describe.
Dex Pod is not following security best practices, which could be a high risk for enterprise operations.

By not explicitly denying privilege escalation, permits a process created within the container to execute a set-user-id, set-group-id, or file capability executable to gain the privileges specified by the executable.

By not explicitly denying container run as root, an attacker could gains access to the container and have full control over the host system.

Describe the solution you'd like
Implement:

  • spec.securityContext.runAsNonRoot
  • spec.containers[*].securityContext.allowPrivilegeEscalation

Screenshot of Security Context section
image

@riqueps riqueps added the kind/enhancement New feature or request label Nov 30, 2023
@riqueps riqueps changed the title Dex - Allow Privilege escalation and run as Root Dex is allowing Privilege escalation and run as Root Nov 30, 2023
@andreas-kupries andreas-kupries added area/security Issue is about security failures, weaknesses, or has security implications kind/bug Something isn't working labels Nov 30, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area/security Issue is about security failures, weaknesses, or has security implications kind/bug Something isn't working kind/enhancement New feature or request
Projects
Status: Icebox
Development

No branches or pull requests

2 participants