Kubernetes container has the SYS_ADMIN capability

Description

SYS_ADMIN in securityContext.capabilities.add is a powerful Linux capability covering many administrative operations, including mounting filesystems. It can weaken isolation and increase the impact of a compromise.

allowPrivilegeEscalation: false does not cancel this capability and cannot be combined with SYS_ADMIN. Remove the unnecessary capability itself.

Potential impact

• A compromised process can perform administrative operations the application does not need.
• Combined with host mounts or other privileges, this can affect the node and other workloads.

Remediation

• Remove unnecessary SYS_ADMIN from securityContext.capabilities.add.
• Determine whether the required function can use narrower permissions or run as a separate, isolated task.
• Review privileged, host mounts and the runtime user. Where compatible, apply allowPrivilegeEscalation: false, then test the application.

Examples

Replace the placeholder image address with the actual application image. The two Pods compare permission settings.

Before

apiVersion: v1
kind: Pod
metadata:
  name: pod4
spec:
  containers:
    - name: app
      image: images.my-company.example/app:v4
      securityContext:
        allowPrivilegeEscalation: true
        capabilities:
          add:
            - SYS_ADMIN

The container allows SYS_ADMIN and privilege escalation. Remove these privileges when the application does not need them.

After

apiVersion: v1
kind: Pod
metadata:
  name: pod1
spec:
  containers:
    - name: app
      image: images.my-company.example/app:v4
      securityContext:
        allowPrivilegeEscalation: false

The added SYS_ADMIN is removed and privilege escalation is restricted. This does not drop every default capability; verify that only required privileges remain.

References

• CWE-250
• Kubernetes security context