misconf: Revise KSV-0022 to allow valid capabilities

[nikpivkin]

Currently, the KSV-0022 check flags all added capabilities, even those allowed by the Pod Security Standard, such as NET_BIND_SERVICE. We need to review and update this check to ensure it aligns with compliance requirements, allows valid capabilities, and provides a clearer, more informative message that specifies which capabilities are causing violations.

Discussed in #9824

[jonkerj]

There might be interaction with KSV003, as this tests if the container drops all capabilities.

[nikpivkin]

@simar7 The KSV022 and KSV106 checks contradict each other as they use different restriction level policies of the same Pod Security Standards:

• The KSV022 title contains "capabilities beyond the default set must not be added", but the check is triggered if capabilities.add contains more than one element, including those allowed by the standard's policy:

  • Undefined/nil
  • AUDIT_WRITE
  • CHOWN
  • DAC_OVERRIDE
  • FOWNER
  • FSETID
  • KILL
  • MKNOD
  • NET_BIND_SERVICE
  • SETFCAP
  • SETGID
  • SETPCAP
  • SETUID
  • SYS_CHROOT

• The KSV106 title contains "Container capabilities must only include NET_BIND_SERVICE", but the check is triggered if capabilities.add is not empty and does not contain exactly one element of NET_BIND_SERVICE.

These checks use different level policies of the same standard. KSV022 disallows any capabilities at all and does not comply with the baseline policy, as it says, while KSV106 allows only NET_BIND_SERVICE and complies with the resitrected policy. Therefore, these checks should not be run together and we should determine which one will be run by default and which one is optional, for example, when specifying a benchmark, if of course there is one for Pod Security Standards.

Should we also review the severity levels of the checks? KSV022 has a medium level, and KSV106 has a low level, although the last check uses a strict compliance policy.

[nikpivkin]

There might be interaction with KSV003, as this tests if the container drops all capabilities.

Thanks for finding it. KSV106 contains two rules, and one of them covers the KSV003 case and is triggered if the container does not drop ALL capabilities. Therefore, these two checks also need to be reviewed.

/сс @simar7

[mattcarp12]

Hello, I'd like to work on this.