Rules / GL076

GL076 docker run --security-opt seccomp=unconfined / apparmor=unconfined in CI script

Severity: warn
OWASP: CICD-SEC-7 – Insecure System Configuration
CWE: CWE-653 – Improper Isolation or Compartmentalization

Risk

--security-opt seccomp=unconfined and --security-opt apparmor=unconfined disable the container's default seccomp or AppArmor profile. These profiles provide kernel-level confinement — seccomp filters the syscalls a container may issue, and AppArmor restricts file, capability, and network operations. Turning either off removes that restriction and widens the container-escape surface.

This is distinct from --privileged (GL056): teams frequently reach for --security-opt seccomp=unconfined as the lighter alternative to full privilege (e.g. to run browsers, debuggers, or nested tooling), so a job can meaningfully weaken confinement while still passing GL056.

Trigger example

test:
  script:
    - docker run --security-opt seccomp=unconfined myimage ./run.sh

Both --security-opt seccomp=unconfined and --security-opt apparmor=unconfined are detected, in space (--security-opt seccomp=unconfined) and = (--security-opt=seccomp=unconfined) forms.

Safe alternative

Keep the default profile. If a specific syscall or behavior is genuinely required, supply a scoped custom profile that allows only what is needed rather than disabling confinement wholesale:

test:
  script:
    - docker run --security-opt seccomp=./my-scoped-profile.json myimage ./run.sh

--security-opt no-new-privileges is a hardening option and is not flagged.

Notes

• Severity is warn.
• Related: GL056 (--privileged), GL057 (--cap-add), GL077 (--ipc host).
• Script-line rule; assumes POSIX shell (see the README Shell assumptions note).
• Suppress per-file with .glsec-ignore or inline # glsec:ignore GL076.

Documentation for glsec 1.23.0. Source of this page · Rule implementation