CME-713

Read-Only Root Filesystem Enforcement

Harden OS/Kernel Deterministic High Confidence

Description

Mount the container root filesystem as read-only, forcing all writable data into explicitly declared volumes or tmpfs mounts. Prevents attackers who achieve code execution inside a container from modifying binaries, planting webshells, or persisting backdoors on the filesystem. Combined with NoNewPrivileges (CME-707) and Dropped Capabilities (CME-705), eliminates post-exploitation persistence mechanisms within the container layer.

CVSS Vector Impacts

Metric	Transition	Rationale
Integrity (I)	H → L	Runtime filesystem modification is blocked; attacker cannot persist malicious artifacts, modify binaries, or plant webshells on the root filesystem
Attack Complexity (AC)	L → H	Exploitation chain requires identifying a writable volume mount to stage payloads; the default filesystem is immutable

CWE Relationships

CWE-269 CWE-94 CWE-506

Verification

Verify container root filesystem is mounted read-only

$ kubectl get pod <pod> -o jsonpath='{.spec.containers[*].securityContext.readOnlyRootFilesystem}'
# Expected: true

Platform: kubernetes

$ podman inspect <ctr> --format '{{.HostConfig.ReadonlyRootfs}}'
# Expected: true

Platform: linux

$ docker inspect <ctr> --format '{{.HostConfig.ReadonlyRootfs}}'
# Expected: true

Platform: linux