From 7fb8d413598461b57f26634d2295a22f79571a53 Mon Sep 17 00:00:00 2001 From: bearsyankees Date: Wed, 22 Apr 2026 14:14:55 -0400 Subject: [PATCH] Clarify cgroup escape requirements --- strix/skills/cloud/kubernetes.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/strix/skills/cloud/kubernetes.md b/strix/skills/cloud/kubernetes.md index 6dbeac0b..09a33585 100644 --- a/strix/skills/cloud/kubernetes.md +++ b/strix/skills/cloud/kubernetes.md @@ -213,7 +213,7 @@ kubectl get pods -o json | jq '.items[].spec.containers[].image' | grep ':latest 3. Test metadata endpoint access early - cloud credentials from pods are the fastest path to cluster-admin 4. Check for `kube-system` namespace access - controllers there often have cluster-admin equivalent permissions 5. `kube-bench` output is noisy but highlights the CIS benchmark failures that matter most -6. Container escapes via cgroup release_agent require both `privileged` and `CAP_SYS_ADMIN` - check both +6. Container escapes via cgroup release_agent require `CAP_SYS_ADMIN` (via `privileged: true` or an explicit capability grant) plus permissive AppArmor/seccomp confinement 7. Helm release secrets (`sh.helm.release.v1.*`) in `kube-system` often contain credentials from chart values 8. DNS from inside a pod reveals service names: `dig +short SRV *.*.svc.cluster.local` 9. When testing RBAC, try `--as=` impersonation to check what other service accounts can do