CME-705

Dropped Linux Capabilities

Isolate OS/Kernel Unquantified evidence Preventive

Description

Removes unnecessary POSIX capabilities from container or process bounding set. Default container profiles drop CAP_SYS_ADMIN, CAP_NET_RAW, CAP_SYS_PTRACE, and others not needed by the workload.

CVSS Vector Impacts

Metric	Transition	Rationale
Privileges Required (PR)	L → H	Even privileged operations require specific capabilities that have been dropped
Scope (S)	C → U	Cannot mount filesystems, trace processes, or perform other scope-changing operations

CWE Relationships

CWE-250 CWE-269

Verification

Check effective capabilities of running process

$ grep CapEff /proc/<pid>/status
# Expected: 0000000000000000 or minimal set

Platform: linux

$ kubectl get pod <pod> -o jsonpath='{.spec.containers[0].securityContext.capabilities.drop}'
# Expected: ALL

Platform: kubernetes

Remediation

kubernetes Kubernetes drop ALL capabilities with minimal add-back


kubectl patch deployment <deployment> -n <namespace> --type=json -p '[{"op":"add","path":"/spec/template/spec/containers/0/securityContext/capabilities","value":{"drop":["ALL"],"add":["NET_BIND_SERVICE"]}}]'
kubectl label namespace <namespace> pod-security.kubernetes.io/enforce=restricted --overwrite

linux Podman/Docker drop ALL capabilities


podman run --cap-drop ALL --cap-add NET_BIND_SERVICE <image>
printf '[containers]\ndefault_capabilities = []\n' > /etc/containers/containers.conf.d/cme-705-drop-caps.conf