kyverno/samples/DisallowNewCapabilities.md

# Disallow new capabilities

Linux allows defining fine-grained permissions using
capabilities. With Kubernetes, it is possible to add capabilities that escalate the
level of kernel access and allow other potentially dangerous behaviors. This policy 
enforces that pods cannot add new capabilities. Other policies can be used to set 
default capabilities. 

## Policy YAML

[disallow_new_capabilities.yaml](best_practices/disallow_new_capabilities.yaml)

````yaml
apiVersion: kyverno.io/v1alpha1
kind: ClusterPolicy
metadata:
  name: validate-new-capabilities
  annotations:
    policies.kyverno.io/category: Security Context
    policies.kyverno.io/description: Linux allows defining fine-grained permissions using
      capabilities. With Kubernetes, it is possible to add capabilities that escalate the
      level of kernel access and allow other potentially dangerous behaviors. This policy 
      enforces that pods cannot add new capabilities. Other policies can be used to set 
      default capabilities. 
spec:
  rules:
  - name: deny-new-capabilities
    match:
      resources:
        kinds:
        - Pod
    validate:
      message: "Capabilities cannot be added"
      anyPattern:
      - spec:
        =(securityContext):
          =(capabilities):
            X(add): null
      - spec:
          containers:
          - name: "*"
            =(securityContext):
              =(capabilities):
                X(add): null
````