Check ID: core_minimize_net_raw_capability_admission
Provider: Kubernetes
Service: core
Severity: HIGH
Categories: container-security
Resource type: Pod

​
What this check verifies

Kubernetes pods where any container’s security context adds the NET_RAW Linux capability are identified. The inspection evaluates container securityContext.capabilities.add entries to detect explicit requests for NET_RAW.

​
Risk

Granting NET_RAW enables raw sockets for packet crafting and sniffing, undermining confidentiality and integrity. Attackers can run ARP/DNS spoofing, pivot or scan inside the cluster, bypass service isolation, exfiltrate data, and impact availability through network abuse.

​
Recommendation

Apply least privilege: avoid adding NET_RAW and drop unnecessary Linux capabilities by default. Use cluster-wide admission policies to block requests for NET_RAW. When strictly required, isolate the workload, restrict egress with network controls, and audit capability use as part of defense in depth.

​
Remediation

resource "kubernetes_pod" "<example_resource_name>" {
  metadata { name = "<example_resource_name>" }
  spec {
    container {
      name  = "<example_resource_name>"
      image = "nginx"
      security_context {
        capabilities {
          drop = ["NET_RAW"] # Critical: ensures the container is not granted NET_RAW
        }
      }
    }
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = core_minimize_net_raw_capability_admission. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Kubernetes checks