Linux Capabilities

Linux Capabilities

Restrict Linux capabilities to the minimum set required by each container. The default approach is to drop all capabilities and selectively add only those the workload needs.

Default: Drop All Capabilities

Every container should drop all Linux capabilities unless specific ones are required:

yamlCopy code
securityContext:
  capabilities:
    drop: ["ALL"]

At minimum, containers must drop MKNOD, SETUID, SETGID, and KILL. Dropping ALL is preferred as it is simpler and more restrictive.

Dangerous Capabilities

The following capabilities are restricted by the certsuite and should not be added unless the workload has a documented exception.

SYS_ADMIN

Provides extensive privileges including mounting filesystems, configuring namespaces, and performing many administrative operations. This is the most dangerous capability — effectively equivalent to running as root.

Required for: all profiles (mandatory) — containers must not use SYS_ADMIN

NET_ADMIN

Allows network configuration changes including interface configuration, firewall rules (iptables/nftables), and routing tables. Workload pods must not configure nftables or iptables — these should be managed by platform operators (e.g., Performance Addon Operator, Istio).

Required for: Telco (mandatory), Far-Edge (mandatory), Extended (mandatory), Non-Telco (optional)

Exception: User plane or networking functions (e.g., SR-IOV, Multicast) may request an exception with documentation of which container needs the capability and why.

NET_RAW

Enables raw socket creation and packet manipulation. Required together with NET_ADMIN for nftables modification, which workload pods should not do.

Required for: Telco (mandatory), Far-Edge (mandatory), Extended (mandatory), Non-Telco (optional)

Exception: User plane or networking functions may request an exception.

BPF

Allows loading eBPF programs into the kernel. eBPF can bypass security controls, monitor other processes, and potentially compromise the host.

Required for: Telco (mandatory), Far-Edge (mandatory), Extended (mandatory), Non-Telco (optional)

IPC_LOCK

Allows locking memory pages with mlock(), mlockall(), shmctl(), and mmap(). Locked memory cannot be swapped, potentially causing denial of service.

Required for: Telco (mandatory), Far-Edge (mandatory), Extended (mandatory), Non-Telco (optional)

Exception: DPDK applications that require locked memory for packet buffers may request an exception.

Required Capabilities

Some workloads must add specific capabilities to perform their required operations.

SYS_NICE (Real-Time Kernel Nodes)

Pods scheduled to nodes with a real-time kernel must add SYS_NICE to allow DPDK applications to switch to SCHED_FIFO scheduling.

Required for: Telco (mandatory), Far-Edge (mandatory), Extended (mandatory), Non-Telco (optional)

yamlCopy code
securityContext:
  capabilities:
    drop: ["ALL"]
    add: ["SYS_NICE"]

SYS_PTRACE (Process Namespace Sharing)

When shareProcessNamespace: true is set on a pod, containers that need to send signals to processes in other containers (e.g., SIGHUP) must have SYS_PTRACE.

Required for: Telco (mandatory), Far-Edge (mandatory), Extended (mandatory), Non-Telco (optional)

yamlCopy code
spec:
  shareProcessNamespace: true
  containers:
    - name: app
      securityContext:
        capabilities:
          drop: ["ALL"]
          add: ["SYS_PTRACE"]

Implementation Checklist

• All containers drop all capabilities (drop: ["ALL"]) or at minimum MKNOD, SETUID, SETGID, KILL
• No containers use SYS_ADMIN
• No containers use NET_ADMIN unless documented exception for user plane functions
• No containers use NET_RAW unless documented exception for user plane functions
• No containers use BPF
• No containers use IPC_LOCK unless documented exception for DPDK
• Pods on real-time kernel nodes add SYS_NICE
• Pods with shareProcessNamespace: true add SYS_PTRACE where needed

Certsuite Test Mapping

References

• Linux Capabilities in OpenShift
• Set Capabilities for a Container
• Share Process Namespace between Containers
• Red Hat Best Practices for Kubernetes Guide
• Red Hat Best Practices Test Suite for Kubernetes (certsuite)