Rules / GL057

GL057 docker run --cap-add with dangerous Linux capabilities

Severity: error for --cap-add ALL; warn for individual dangerous capabilities
OWASP: CICD-SEC-7 – Insecure System Configuration
CWE: CWE-250 – Execution with Unnecessary Privileges

Risk

docker run --cap-add ALL grants every Linux capability to the container — equivalent to --privileged for most practical purposes. Other dangerous individual capabilities can also be abused to escape the container or affect the host:

• SYS_ADMIN — mount, pivot_root, and many other kernel operations
• SYS_PTRACE — read/write arbitrary process memory
• SYS_MODULE — load/unload kernel modules
• NET_ADMIN — reconfigure network interfaces, iptables, etc.

When passed in a CI script, these capabilities are granted at job runtime. A supply-chain attack or injected variable reaching this job gains greatly elevated access to the runner host.

Trigger example

test:
  script:
    - docker run --cap-add ALL myimage ./test.sh          # error
    - docker run --cap-add SYS_ADMIN myimage ./mount.sh    # warn

Both --cap-add NAME and --cap-add=NAME forms are detected, with or without a CAP_ prefix, case-insensitively.

Safe alternative

Grant only the specific capability actually needed, and document why:

test:
  script:
    - docker run --cap-add NET_BIND_SERVICE myimage ./server-test.sh

Or redesign the test to avoid requiring elevated capabilities.

Notes

• --cap-add ALL is an error (equivalent to --privileged); individual dangerous capabilities are warn.
• The flagged set is curated: SYS_ADMIN, SYS_PTRACE, SYS_MODULE, NET_ADMIN. Common low-risk capabilities such as NET_BIND_SERVICE are not flagged.
• Related: GL056 (docker run --privileged).
• Script-line rule; assumes POSIX shell (see the README Shell assumptions note).
• Suppress per-file with .glsec-ignore or inline # glsec:ignore GL057.

Documentation for glsec 1.23.0. Source of this page · Rule implementation