Container Run as Root User

Description

Container detected running as the root user. This should be taken into account especially when policies disallow containers from running with root user privileges. Note that a root user in containers doesn't inherently possess extensive power, as modern container environments define privileges through Linux capabilities. To learn more, check out the rule "Launch Privileged Container".

Query · falco

spawned_process and container and proc.vpid=1 and user.uid=0 and not user_known_run_as_root_container

Rule dependencies

Depends on

  • composes · Falco macro container
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro spawned_process
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_known_run_as_root_container
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Container launched with root user privilege | evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Raw source Container Run as Root User · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Container Run as Root User
desc: 'Container detected running as the root user. This should be taken into account
  especially when policies disallow containers from running with root user privileges.
  Note that a root user in containers doesn''t inherently possess extensive power,
  as modern container environments define privileges through Linux capabilities. To
  learn more, check out the rule "Launch Privileged Container".

  '
condition: 'spawned_process and container and proc.vpid=1 and user.uid=0 and not user_known_run_as_root_container

  '
enabled: false
output: Container launched with root user privilege | evt_type=%evt.type user=%user.name
  user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath
  parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags
priority: INFO
tags:
- maturity_sandbox
- container
- process
- users
- mitre_execution
- T1610

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.