Allowing /usr/bin/busybox in turn allows multiple executables inside a pod

[venkateshjayagopal]

Is there an existing issue for this?

• I have searched the existing issues

Environment

- OS: Ubuntu
- Architecture: x86
- Cluster: RKE2

Issue Description

• Expected behavior: We should not allow multiple binaries to be executed when executing /usr/bin/busybox.
• Current behavior: Allowing /usr/bin/busybox in WorkloadPolicy allows multiple binaries such as vi, cat, whoami binaries inside a pod which are not allowed in WorkloadPolicy
• Steps to reproduce:
• Deploy /usr/bin/busybox, allow /usr/bin/busybox executable.
• Move the WorkloadPolicy to "Protect" mode
• Observe if you can execute other binaries.

ubuntu@master-node-01 21:37:43:~$ kubectl get wp deploy-httpserver4-node1 -o yaml -n httpserver
apiVersion: security.rancher.io/v1alpha1
kind: WorkloadPolicy
metadata:
  creationTimestamp: "2026-07-27T20:19:42Z"
  generation: 2
  labels:
    security.rancher.io/promoted-from: deploy-httpserver4-node1
  name: deploy-httpserver4-node1
  namespace: httpserver
  resourceVersion: "45807478"
  uid: 5686b902-9ee2-410c-91c2-77defe8137a4
spec:
  mode: protect
  rulesByContainer:
    bootstrap:
      executables:
        allowed:
        - /bin/busybox
        - /usr/bin/curl
    httpserver:
      executables:
        allowed:
        - /usr/local/bin/node
status:
  activeViolationCount: 1
  observedGeneration: 2
  phase: Ready
  successfulNodes: 3
  totalNodes: 3
  violationCount: 1
  violations:
  - action: protect
    containerName: bootstrap
    executablePath: /runc
    id: 0
    nodeName: susesecurity-worker-01
    podName: httpserver4-node1-c54d58999-vhq9b
    timestamp: "2026-07-27T21:36:35Z"
    workloadKind: Deployment
    workloadName: httpserver4-node1

ubuntu@master-node-01 21:40:55:~$ kubectl get deployment httpserver4-node1 -o yaml -n httpserver
apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    deployment.kubernetes.io/revision: "1"
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"apps/v1","kind":"Deployment","metadata":{"annotations":{"deployment.kubernetes.io/revision":"1"},"name":"httpserver4-node1","namespace":"httpserver"},"spec":{"progressDeadlineSeconds":600,"replicas":1,"revisionHistoryLimit":10,"selector":{"matchLabels":{"app":"httpserver4-node1"}},"strategy":{"rollingUpdate":{"maxSurge":"25%","maxUnavailable":"25%"},"type":"RollingUpdate"},"template":{"metadata":{"creationTimestamp":null,"labels":{"app":"httpserver4-node1","security.rancher.io/policy":"deploy-httpserver4-node1","version":"v1"}},"spec":{"affinity":{"nodeAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":{"nodeSelectorTerms":[{"matchExpressions":[{"key":"nvcontroller","operator":"NotIn","values":["true"]}]}]}}},"containers":[{"image":"ealen/echo-server:latest","imagePullPolicy":"Always","name":"httpserver","ports":[{"containerPort":80,"protocol":"TCP"}],"resources":{},"securityContext":{"seLinuxOptions":{"type":"container_runtime_t"}},"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File"},{"command":["/bin/sh","-c","while true; do for i in  `seq 1 10`; do curl httpserver$i-node0:80; sleep 1; done; curl httpserver4-node1:80; sleep 3; done"],"image":"quay.io/nvlab/iperf","imagePullPolicy":"Always","name":"bootstrap","resources":{},"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File"}],"dnsPolicy":"ClusterFirst","imagePullSecrets":[{"name":"my-secret"}],"restartPolicy":"Always","schedulerName":"default-scheduler","securityContext":{},"terminationGracePeriodSeconds":30}}}}
  creationTimestamp: "2026-07-27T21:30:39Z"
  generation: 1
  name: httpserver4-node1
  namespace: httpserver
  resourceVersion: "45802242"
  uid: cf948367-8853-436b-9262-eaf1bce5ed02
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app: httpserver4-node1
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: httpserver4-node1
        security.rancher.io/policy: deploy-httpserver4-node1
        version: v1
    spec:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: nvcontroller
                operator: NotIn
                values:
                - "true"
      containers:
      - image: ealen/echo-server:latest
        imagePullPolicy: Always
        name: httpserver
        ports:
        - containerPort: 80
          protocol: TCP
        resources: {}
        securityContext:
          seLinuxOptions:
            type: container_runtime_t
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
      - command:
        - /bin/sh
        - -c
        - while true; do for i in  `seq 1 10`; do curl httpserver$i-node0:80; sleep
          1; done; curl httpserver4-node1:80; sleep 3; done
        image: quay.io/nvlab/iperf
        imagePullPolicy: Always
        name: bootstrap
        resources: {}
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
      dnsPolicy: ClusterFirst
      imagePullSecrets:
      - name: my-secret
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext: {}
      terminationGracePeriodSeconds: 30
status:
  availableReplicas: 1
  conditions:
  - lastTransitionTime: "2026-07-27T21:30:41Z"
    lastUpdateTime: "2026-07-27T21:30:41Z"
    message: Deployment has minimum availability.
    reason: MinimumReplicasAvailable
    status: "True"
    type: Available
  - lastTransitionTime: "2026-07-27T21:30:39Z"
    lastUpdateTime: "2026-07-27T21:30:41Z"
    message: ReplicaSet "httpserver4-node1-c54d58999" has successfully progressed.
    reason: NewReplicaSetAvailable
    status: "True"
    type: Progressing
  observedGeneration: 1
  readyReplicas: 1
  replicas: 1
  terminatingReplicas: 0
  updatedReplicas: 1

ubuntu@master-node-01 21:36:27:~/httpserver$ kubectl exec -ti httpserver4-node1-c54d58999-vhq9b -c bootstrap -n httpserver -- sh                         / # whoami
root
/ # vi temp
/ #
/ # exit

[dottorblaster]

As an actionable from this the only thing we can do is updating the docs with a stronger emphasis on this, since allowing busybox is basically allowing a full fledged userland coreutils clone into a working environment. Thanks for pointing this out.