search

wazuh / wazuh-kubernetes

Wazuh - Wazuh Kubernetes
https://wazuh.com/
GNU General Public License v2.0
256 stars 160 forks source link

Root priviliges #628

Open bervel opened 6 months ago

bervel commented 6 months ago

Are there any plans to move away from running containers under root privileges? This is very problematic from the security perspective, practically requires a dedicated k8s cluster for wazuh deployment alone. For example, it's not even possible to deploy on openshift because of this without turning off default security policies.


            capabilities:
              add: ["SYS_CHROOT"]
Yaren-IT commented 3 months ago

The cap_add was introduced in relation to this issue and present on every STS. The question arises as to whether this capability is needed at all if you start with "runAsNonRoot: true" and can therefore completely omit the "SYS_CHROOT". Or are there other effects?