By default, containers are allowed to make modification to files. This unnecessary privilege increases the cluster attack surface as commonly containers do not need a writable filesystem.

Remediation

The following example makes the root file system read only.

apiVersion: apps/v1
kind: Deployment
spec:
  template:
    spec:
      containers:
      - name: app
        securityContext:
          readOnlyRootFilesystem: true

Metadata

• Severity: informational
• Slug: filesystem-writable

CWEs

• 269: Improper Privilege Management

OWASP

• A04:2021: Insecure Design
• A05:2021: Security Misconfiguration