auditing-host-mount-and-device-exposure

name	auditing-host-mount-and-device-exposure
description	Audit the host paths and devices a workload mounts for reach across the container boundary onto the node: a writable hostPath into a sensitive node directory, a mount of the host root or a system path that exposes other pods' data and node configuration, a raw device or block volume that grants low-level host access, and a hostPath whose subpath or symlink handling lets a workload escape the intended directory. Covers Kubernetes and container hosts where hostPath volumes and device mounts connect a container to the node filesystem and hardware. Use when workloads mount host paths or devices and the question is what node state that mount exposes. The workload holding the host mount is the source, the node file or device it reaches is the sink, and the host-path or device exposure beyond the workload's need is the bug.
license	MIT

Auditing host mount and device exposure: a path into the node filesystem

A hostPath volume or a device mount is a hole cut in the container boundary: it connects the workload directly to the node's filesystem or hardware. Sometimes that is genuinely needed, a node agent reading a specific system directory, but the exposure is defined by what the mount reaches, not by why it was added. A writable hostPath into a sensitive node directory lets the workload alter node state; a mount of the host root or a broad system path exposes other pods' data, node configuration, and credentials; a raw device or block volume grants low-level access that bypasses filesystem controls; and a hostPath with loose subpath or symlink handling can be walked out of its intended directory into the rest of the node. The audit treats each host mount as node reach and asks how far it goes. You audit this by inventorying every host-path and device mount and determining exactly what node state each exposes and whether it is writable.

When to use

• Workloads mount hostPath volumes or devices that connect the container to the node filesystem or hardware.