Prisma Cloud Compute Defender containers must run as root.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-253546	SRG-APP-000414-CTR-001010	CNTR-PC-001350	SV-253546r1050656_rule	2024-12-06	2

Description
In certain situations, the nature of the vulnerability scanning may be more intrusive, or the container platform component that is the subject of the scanning may contain highly sensitive information. To protect the sensitive nature of such scanning, Prisma Cloud Compute Defenders perform the vulnerability scanning function. The Defender container must run as root and not privileged.

ℹ️ Check
Verify that when deploying the Defender via daemonSet, "Run Defenders as privileged" is set to "On". Verify the Defender containers were deployed using the daemonSet.yaml in which the securityContext is privileged (privileged = "on"). If "Run Defenders as privileged" is not set to "On" or the Defender containers were not deployed using the daemonSet.yaml in which the securityContext - privileged = "on", this is a finding.

ℹ️ Check

Verify that when deploying the Defender via daemonSet, "Run Defenders as privileged" is set to "On". Verify the Defender containers were deployed using the daemonSet.yaml in which the securityContext is privileged (privileged = "on"). If "Run Defenders as privileged" is not set to "On" or the Defender containers were not deployed using the daemonSet.yaml in which the securityContext - privileged = "on", this is a finding.

✔️ Fix
Redeploy the Defender with appropriate rights by setting "Run Defenders as privileged" to "On". Delete the old twistlock-defender-ds daemonSet and redeploy daemonSet with the new yaml in which the securityContext - privileged = "on".