Discuss Linux Foundation KCSA Exam Topic 5 Question 17

A container running in a Kubernetes cluster has permission to modify host processes on the underlying node.

What combination of privileges and capabilities is most likely to have led to this privilege escalation?

AThere is no combination of privileges and capabilities that permits this.

BhostPID and SYS_PTRACE

ChostPath and AUDIT_WRITE

DhostNetwork and NET_RAW

Suggested Answer: A

18 comments · newest first

Britt 1 month ago

So, B it is then. Let's hope for the best!

Georgene 2 months ago

Right, it’s more about logging than modifying.

Beckie 2 months ago

C seems less likely. AUDIT_WRITE doesn't modify processes.

Britt 2 months ago

True, but I wonder if C could be a possibility too.

Georgene 2 months ago

Exactly! SYS_PTRACE is powerful for debugging.

Beckie 2 months ago

I doubt it. The capabilities are there for a reason.

Britt 2 months ago

But what about A? Could there really be no combination?

Georgene 3 months ago

I agree, B makes sense. hostPID allows access to host processes.

Beckie 3 months ago

This question is tricky. I think B is the right answer.

Tiera 3 months ago

Isn't it risky to give those permissions in the first place?

Shala 3 months ago

C is a stretch, not sure it fits the scenario.

Iluminada 3 months ago

Wow, I didn't know hostPID could do that!

Jutta 3 months ago

I disagree, I think it's A. No way to modify host processes!

King 4 months ago

B) hostPID and SYS_PTRACE seems right.

Caitlin 4 months ago

I feel like hostNetwork and NET_RAW are more about network capabilities. They don’t seem to relate to modifying host processes.

Jade 4 months ago

I don’t recall hostPath being related to modifying processes directly. I thought it was more about file system access.

Sophia 4 months ago

I’m not entirely sure, but I think SYS_PTRACE might be involved in modifying processes. It sounds familiar from our practice questions.

Mee 4 months ago

I remember reading that hostPID allows a container to see and interact with processes on the host, which could lead to privilege escalation.

Linux Foundation KCSA Exam - Topic 5 Question 17 Discussion