A container running in a Kubernetes cluster has permission to modify host processes on the underlying node. What combination of privileges and capabilities is most likely to have led to this privilege escalation?

This scenario describes a container breakout achieved through process injection. The hostPID: true setting in a Pod's security context breaks the process ID (PID) namespace isolation. This allows processes inside the container to see all other processes running on the host node. However, seeing the processes is not enough to modify them. The SYSPTRACE Linux capability grants the permission to trace and manipulate arbitrary processes using system calls like ptrace(2). The combination of seeing host processes (hostPID) and having the permission to manipulate them (SYSPTRACE) directly enables this privilege escalation.

A. This is incorrect because misconfigurations of privileges and capabilities are a well-documented vector for container escape and privilege escalation in Kubernetes.
C. hostPath grants access to the host's filesystem, not its processes. AUDITWRITE allows writing to the kernel audit log, which is unrelated to process manipulation.
D. hostNetwork grants access to the host's network stack, and NETRAW allows crafting raw network packets. These are network-related privileges, not process control privileges.

1. Kubernetes Official Documentation

Pod Security Standards: The "Baseline" policy explicitly disallows setting hostPID to true

highlighting its security risk. The documentation states

"The baseline policy is a set of controls that prevent known privilege escalations."

Source: Kubernetes Documentation > Reference > Security > Pod Security Standards

Section: Policy definitions > Baseline > Host Namespaces (spec.hostPID

spec.hostIPC)

2. Kubernetes Official Documentation

Configure a Security Context for a Pod or Container: This document explains how to set security context fields

including Linux capabilities. It shows the syntax for adding capabilities like SYSPTRACE to a container

which grants privileges not given by default.

Source: Kubernetes Documentation > Tasks > Configure Pods and Containers > Configure a Security Context for a Pod or Container

Section: Set capabilities for a Container

3. Linux Programmer's Manual

capabilities(7): The official Linux man page defines the SYSPTRACE capability.

Source: man 7 capabilities

Section: CAPSYSPTRACE

Quote: "Trace arbitrary processes using ptrace(2)... This capability is required to attach to other processes." The ptrace system call is the primary mechanism for debugging

inspecting

and modifying another process's memory and registers.