Dangerous Linux Capabilities Added

Description

Detects containers adding dangerous Linux capabilities like SYS_ADMIN, NET_ADMIN, or SYS_PTRACE.

What Shoulder detects

Container adds dangerous Linux capabilities like SYS_ADMIN, NET_ADMIN, or SYS_PTRACE.

How to fix

Remove dangerous capabilities and drop ALL.

```yaml
securityContext:
  capabilities:
    drop: [ALL]
```

Learn more: https://shoulder.dev/learn/kubernetes/cwe-250/dangerous-capabilities

Applies to

Languages

📄 YAML

Frameworks

kubernetes

References

Documentation ↗ Learn about CWE-250

Scan for this issue

Detect with Shoulder CLI

npx @shoulderdev/cli trust --rule=kubernetes-dangerous-capabilities .