Menu
Minimize admission of containers with allowPrivilegeEscalation (Manual)
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-ocp-v170-5-2-5The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Based on SOC occupation classification
Showing SKILL.md
| name | cis-ocp-v170-5.2.5 |
| description | Minimize admission of containers with allowPrivilegeEscalation (Manual) |
| category | cis-openshift |
| version | 1.7.0 |
| author | cyberstrike-official |
| tags | ["cis","openshift","kubernetes","redhat","policies","security-context-constraints"] |
| cis_id | 5.2.5 |
| cis_benchmark | CIS Red Hat OpenShift Container Platform Benchmark v1.7.0 |
| tech_stack | ["kubernetes","openshift","redhat"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Do not generally permit containers to be run with the allowPrivilegeEscalation flag set to true.
A container running with the allowPrivilegeEscalation flag set to true may have processes that can gain more privileges than their parent.
There should be at least one Security Context Constraint (SCC) defined which does not permit containers to allow privilege escalation. The option exists (and is defaulted to true) to permit setuid binaries to run.
If you have need to run containers which use setuid binaries or require privilege escalation, this should be defined in a separate SCC and you should carefully check RBAC controls to ensure that only limited service accounts and users are given permission to access that SCC.
Pods defined with Allow Privilege Escalation: true will not be permitted unless they are run under a specific SCC.
Use the following command to list all SCCs with allowPrivilegeEscalation set to false:
oc get scc -A -o json | jq '.items[] |
select(.allowPrivilegeEscalation==false) | .metadata.name'
Verify that there is at least one SCC is returned.
Create an SCC that sets allowPrivilegeEscalation to false and take it into use by assigning it to applicable users and groups.
By default, the following SCCs do not allow privilege escalation:
"hostnetwork-v2"
"nonroot-v2"
"restricted-v2"
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 |
| 5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts |
| * |
| * |
| * |
| v8 | 12.8 Establish and Maintain Dedicated Computing Resources for All Administrative Work | * |
| v7 | 4.3 Ensure the Use of Dedicated Administrative Accounts | * | * | * |
| Techniques / Sub-techniques | Tactics | Mitigations |
|---|---|---|
| T1611 | TA0004 | M1038, M1048 |
Level 1 (Manual)