<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
# Privileged Container Abuse — API Reference

## Linux Capabilities Reference

| Capability | Effect | Risk |
|-----------|--------|------|
| `SYS_ADMIN` | Mount, namespaces, cgroups | Critical |
| `SYS_PTRACE` | Trace/debug processes | High |
| `SYS_RAWIO` | Direct I/O port access | Critical |
| `NET_ADMIN` | Network configuration | High |
| `SYS_MODULE` | Load kernel modules | Critical |
| `DAC_READ_SEARCH` | Bypass file read permissions | High |

## kubectl Audit Commands

```bash
kubectl get pods -A -o json | jq '[.items[] | select(.spec.containers[].securityContext.privileged == true)]'
kubectl get pods -A -o json | jq '[.items[] | select(.spec.containers[].securityContext.capabilities.add != null)]'
kubectl get pods -A -o json | jq '[.items[] | select(.spec.volumes[].hostPath != null)]'
```

## Security Context Fields

```yaml
securityContext:
  privileged: false
  runAsNonRoot: true
  runAsUser: 1000
  readOnlyRootFilesystem: true
  allowPrivilegeEscalation: false
  capabilities:
    drop: [ALL]
    add: []
  seccompProfile:
    type: RuntimeDefault
```
