Has No Seccomp Profile Set

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: initcontainer-seccomp-profile-restricted
  annotations:
    kubeapt.io/uuid: "e936441f-96f4-4bfa-a70a-97b1ca8b369d"
    security.kubeapt.io/displayName: "Has No Seccomp Profile Set"
    security.kubeapt.io/description: "An init container with no seccomp profile enforced at pod or init container level runs with no syscall filter, leaving the full kernel syscall surface reachable for container escape and privilege escalation."
    security.kubeapt.io/resource: "InitContainers"
    security.kubeapt.io/severity: "Moderate"
    security.kubeapt.io/remediation: "Set the seccomp type to RuntimeDefault, or to Localhost naming a profile loaded on the node, on each init container or once at pod level. Fields: spec.initContainers[*].securityContext.seccompProfile.type, spec.securityContext.seccompProfile.type."
    security.kubeapt.io/product: "Kubernetes"
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
    - apiGroups:
      - ''
      apiVersions:
      - v1
      operations:
      - CREATE
      - UPDATE
      resources:
      - pods
  variables:
  - name: allowedSeccompTypes
    expression: |
      ["RuntimeDefault","Localhost"]
  - name: podTypePresent
    expression: |
      has(object.spec.securityContext) && has(object.spec.securityContext.seccompProfile) && has(object.spec.securityContext.seccompProfile.type)
  - name: podTypeAllowed
    expression: |
      variables.podTypePresent && variables.allowedSeccompTypes.exists(t, t == object.spec.securityContext.seccompProfile.type)
  validations:
  - expression: |
      (has(object.spec.os) &&
       has(object.spec.os.name) &&
       object.spec.os.name.lowerAscii() == "windows") ||
      (variables.podTypeAllowed &&
       (!has(object.spec.initContainers) ||
        object.spec.initContainers.all(ic,
          !has(ic.securityContext) ||
          !has(ic.securityContext.seccompProfile) ||
          !has(ic.securityContext.seccompProfile.type) ||
          variables.allowedSeccompTypes.exists(t, t == ic.securityContext.seccompProfile.type)
        )
       )
      ) || (!variables.podTypePresent &&
       (!has(object.spec.initContainers) ||
        object.spec.initContainers.all(ic,
          has(ic.securityContext) &&
          has(ic.securityContext.seccompProfile) &&
          has(ic.securityContext.seccompProfile.type) &&
          variables.allowedSeccompTypes.exists(t, t == ic.securityContext.seccompProfile.type)
        )
       )
      )
    message: |
      spec.initContainers[*].securityContext.seccompProfile.type must be "RuntimeDefault" or "Localhost". Init container fields may be undefined only when the Pod-level spec.securityContext.seccompProfile.type is set to "RuntimeDefault" or "Localhost"; otherwise every init container must set its own to one of those values.