How deeply does Google Anthos in Action cover privilege escalation?

Explains privileged containers, root execution, and policy enforcement trade-offs, but stops short of configuration commands.

Privilege escalation

As explained in Google Anthos in Action

Privilege escalation is the acquisition of permissions or capabilities beyond those initially granted to a process or workload.

Privilege escalation occurs when a container or workload gains permissions or capabilities beyond its initial grant. In Kubernetes, a container with the privileged flag can break out and affect the host as a superuser. section 13.3.2

Reduce the main escalation paths by:

Forcing containers to prevent privilege escalation. section 13.3.2
Preventing images from running as the root user by default; publicly available images may use root to avoid internal permission problems. section 13.3.2
Evaluating admission controls carefully: PodSecurityPolicy was deprecated starting in Kubernetes 1.21 and is removed in its current form in 1.25, while organizations often adopted Gatekeeper instead. section 13.3.2

How Google Anthos in Action covers it

liveBook manning.com

Read Google Anthos in Action on liveBook Get the book at manning.com

Also explained in

liveBook manning.com

Secure APIsPrivilege escalation is the gaining of permissions or capabilities beyond those originally authorized for a user, service, or process.
liveBook manning.com

PostgreSQL Mistakes and How to Avoid ThemPrivilege escalation is the acquisition or exercise of permissions beyond those originally granted to a user or process.

Compare how 3 books explain privilege escalation →

Related concepts

SSRFproduced by · Server-side request forgery is an attack in which an adversary induces a server to send requests to attacker-selected internal or external network resources.
overpostingproduced by · Overposting is a security vulnerability in which client-supplied fields are automatically bound to application properties that were not intended for client modification.
security definerproduced by · SECURITY DEFINER is a PostgreSQL function execution mode that runs the function with the privileges of its owner rather than its caller.
role-based access controladdressed by · Role-based access control is an authorization model that assigns permissions to roles and grants users or other principals access through their assigned roles.

This explainer was generated by Manning's knowledge graph from the text of Google Anthos in Action. The section links point to the parts of the book it draws on.