Skip to content

Commit 1a7ae10

Browse files
slashbenslashben
authored
Merge pull request #11 from suhasgumma/C-0013
ValidatingAdmissionPolicy for C-0013
2 parents cdd5d31 + 4faf391 commit 1a7ae10

File tree

2 files changed

+378
-0
lines changed

2 files changed

+378
-0
lines changed

‎controls/C-0013/policy.yaml

+194
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,194 @@
1+
apiVersion: admissionregistration.k8s.io/v1alpha1
2+
kind: ValidatingAdmissionPolicy
3+
metadata:
4+
name: "kubescape-c-0013-deny-resources-with-capability-to-run-as-root"
5+
spec:
6+
failurePolicy: Fail
7+
matchConstraints:
8+
resourceRules:
9+
- apiGroups: [""]
10+
apiVersions: ["v1"]
11+
operations: ["CREATE", "UPDATE"]
12+
resources: ["pods"]
13+
- apiGroups: ["apps"]
14+
apiVersions: ["v1"]
15+
operations: ["CREATE", "UPDATE"]
16+
resources: ["deployments","replicasets","daemonsets","statefulsets"]
17+
- apiGroups: ["batch"]
18+
apiVersions: ["v1"]
19+
operations: ["CREATE", "UPDATE"]
20+
resources: ["jobs","cronjobs"]
21+
validations:
22+
- expression: >
23+
object.kind != 'Pod' || object.spec.containers.all(container,
24+
(
25+
(
26+
has(container.securityContext) &&
27+
has(container.securityContext.allowPrivilegeEscalation) &&
28+
container.securityContext.allowPrivilegeEscalation == false
29+
) ||
30+
(
31+
(
32+
!has(container.securityContext) || !has(container.securityContext.allowPrivilegeEscalation)
33+
) &&
34+
(
35+
has(object.spec.securityContext) &&
36+
has(object.spec.securityContext.allowPrivilegeEscalation) &&
37+
object.spec.securityContext.allowPrivilegeEscalation == false
38+
)
39+
)
40+
) &&
41+
(
42+
(
43+
(
44+
has(container.securityContext) &&
45+
has(container.securityContext.runAsNonRoot) &&
46+
container.securityContext.runAsNonRoot == true
47+
) ||
48+
(
49+
(
50+
!has(container.securityContext) || !has(container.securityContext.runAsNonRoot)
51+
) &&
52+
(
53+
has(object.spec.securityContext) &&
54+
has(object.spec.securityContext.runAsNonRoot) &&
55+
object.spec.securityContext.runAsNonRoot == true
56+
)
57+
)
58+
) ||
59+
(
60+
(
61+
has(container.securityContext) &&
62+
has(container.securityContext.runAsUser) &&
63+
container.securityContext.runAsUser != 0
64+
) ||
65+
(
66+
(
67+
!has(container.securityContext) || !has(container.securityContext.runAsUser)
68+
) &&
69+
(
70+
has(object.spec.securityContext) &&
71+
has(object.spec.securityContext.runAsUser) &&
72+
object.spec.securityContext.runAsUser != 0
73+
)
74+
)
75+
)
76+
)
77+
)
78+
message: "Pods contains container/s which have the capability to run as root! (see more at https://hub.armosec.io/docs/c-0013)"
79+
80+
- expression: >
81+
['Deployment','ReplicaSet','DaemonSet','StatefulSet','Job'].all(kind, object.kind != kind) || object.spec.template.spec.containers.all(container,
82+
(
83+
(
84+
has(container.securityContext) &&
85+
has(container.securityContext.allowPrivilegeEscalation) &&
86+
container.securityContext.allowPrivilegeEscalation == false
87+
) ||
88+
(
89+
(
90+
!has(container.securityContext) || !has(container.securityContext.allowPrivilegeEscalation)
91+
) &&
92+
(
93+
has(object.spec.template.spec.securityContext) &&
94+
has(object.spec.template.spec.securityContext.allowPrivilegeEscalation) &&
95+
object.spec.template.spec.securityContext.allowPrivilegeEscalation == false
96+
)
97+
)
98+
) &&
99+
(
100+
(
101+
(
102+
has(container.securityContext) &&
103+
has(container.securityContext.runAsNonRoot) &&
104+
container.securityContext.runAsNonRoot == true
105+
) ||
106+
(
107+
(
108+
!has(container.securityContext) || !has(container.securityContext.runAsNonRoot)
109+
) &&
110+
(
111+
has(object.spec.template.spec.securityContext) &&
112+
has(object.spec.template.spec.securityContext.runAsNonRoot) &&
113+
object.spec.template.spec.securityContext.runAsNonRoot == true
114+
)
115+
)
116+
) ||
117+
(
118+
(
119+
has(container.securityContext) &&
120+
has(container.securityContext.runAsUser) &&
121+
container.securityContext.runAsUser != 0
122+
) ||
123+
(
124+
(
125+
!has(container.securityContext) || !has(container.securityContext.runAsUser)
126+
) &&
127+
(
128+
has(object.spec.template.spec.securityContext) &&
129+
has(object.spec.template.spec.securityContext.runAsUser) &&
130+
object.spec.template.spec.securityContext.runAsUser != 0
131+
)
132+
)
133+
)
134+
)
135+
)
136+
message: "Workloads contains container/s which have the capability to run as root! (see more at https://hub.armosec.io/docs/c-0013)"
137+
138+
- expression: >
139+
object.kind != 'CronJob' || object.spec.jobTemplate.spec.containers.all(container,
140+
(
141+
(
142+
has(container.securityContext) &&
143+
has(container.securityContext.allowPrivilegeEscalation) &&
144+
container.securityContext.allowPrivilegeEscalation == false
145+
) ||
146+
(
147+
(
148+
!has(container.securityContext) || !has(container.securityContext.allowPrivilegeEscalation)
149+
) &&
150+
(
151+
has(object.spec.jobTemplate.spec.securityContext) &&
152+
has(object.spec.jobTemplate.spec.securityContext.allowPrivilegeEscalation) &&
153+
object.spec.jobTemplate.spec.securityContext.allowPrivilegeEscalation == false
154+
)
155+
)
156+
) &&
157+
(
158+
(
159+
(
160+
has(container.securityContext) &&
161+
has(container.securityContext.runAsNonRoot) &&
162+
container.securityContext.runAsNonRoot == true
163+
) ||
164+
(
165+
(
166+
!has(container.securityContext) || !has(container.securityContext.runAsNonRoot)
167+
) &&
168+
(
169+
has(object.spec.jobTemplate.spec.securityContext) &&
170+
has(object.spec.jobTemplate.spec.securityContext.runAsNonRoot) &&
171+
object.spec.jobTemplate.spec.securityContext.runAsNonRoot == true
172+
)
173+
)
174+
) ||
175+
(
176+
(
177+
has(container.securityContext) &&
178+
has(container.securityContext.runAsUser) &&
179+
container.securityContext.runAsUser != 0
180+
) ||
181+
(
182+
(
183+
!has(container.securityContext) || !has(container.securityContext.runAsUser)
184+
) &&
185+
(
186+
has(object.spec.jobTemplate.spec.securityContext) &&
187+
has(object.spec.jobTemplate.spec.securityContext.runAsUser) &&
188+
object.spec.jobTemplate.spec.securityContext.runAsUser != 0
189+
)
190+
)
191+
)
192+
)
193+
)
194+
message: "CronJob contains container/s which have the capability to run as root! (see more at https://hub.armosec.io/docs/c-0013)"

‎controls/C-0013/tests.json

+184
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,184 @@
1+
[
2+
{
3+
"name": "Pod with PodSecurityContext not set and allowPreviligeEscalation not set in atleast one ContainerSecurityContext is blocked",
4+
"template": "pod.yaml",
5+
"expected": "fail",
6+
"field_change_list": [
7+
]
8+
},
9+
{
10+
"name": "Pod with PodSecurityContext not set and ContainerSecurityContext runAsUser is non-zero and allowPreviligeEscalation set to false is allowed",
11+
"template": "pod.yaml",
12+
"expected": "pass",
13+
"field_change_list": [
14+
"spec.containers.[0].securityContext.runAsUser=100",
15+
"spec.containers.[0].securityContext.allowPrivilegeEscalation=false"
16+
]
17+
},
18+
{
19+
"name": "Pod with PodSecurityContext not set and ContainerSecurityContext runAsNonRoot set to true and allowPreviligeEscalation set to false is allowed",
20+
"template": "pod.yaml",
21+
"expected": "pass",
22+
"field_change_list": [
23+
"spec.containers.[0].securityContext.runAsNonRoot=true",
24+
"spec.containers.[0].securityContext.allowPrivilegeEscalation=false"
25+
]
26+
},
27+
{
28+
"name": "Pod with PodSecurityContext not set and ContainerSecurityContext runAsUser is non-zero, runAsNonRoot set to true and allowPreviligeEscalation set to false is allowed",
29+
"template": "pod.yaml",
30+
"expected": "pass",
31+
"field_change_list": [
32+
"spec.containers.[0].securityContext.runAsNonRoot=true",
33+
"spec.containers.[0].securityContext.runAsUser=100",
34+
"spec.containers.[0].securityContext.allowPrivilegeEscalation=false"
35+
]
36+
},
37+
{
38+
"name": "Pod with PodSecurityContext not set and ContainerSecurityContext runAsUser is non-zero and allowPreviligeEscalation set to true is denied",
39+
"template": "pod.yaml",
40+
"expected": "fail",
41+
"field_change_list": [
42+
"spec.containers.[0].securityContext.runAsUser=100",
43+
"spec.containers.[0].securityContext.allowPrivilegeEscalation=true"
44+
]
45+
},
46+
{
47+
"name": "Pod with PodSecurityContext not set and ContainerSecurityContext runAsNonRoot set to true and allowPreviligeEscalation set to true is denied",
48+
"template": "pod.yaml",
49+
"expected": "fail",
50+
"field_change_list": [
51+
"spec.containers.[0].securityContext.runAsNonRoot=true",
52+
"spec.containers.[0].securityContext.allowPrivilegeEscalation=true"
53+
]
54+
},
55+
{
56+
"name": "Pod with PodSecurityContext not set and ContainerSecurityContext runAsUser is non-zero, runAsNonRoot set to true and allowPreviligeEscalation set to true is denied",
57+
"template": "pod.yaml",
58+
"expected": "fail",
59+
"field_change_list": [
60+
"spec.containers.[0].securityContext.runAsNonRoot=true",
61+
"spec.containers.[0].securityContext.runAsUser=100",
62+
"spec.containers.[0].securityContext.allowPrivilegeEscalation=true"
63+
]
64+
},
65+
{
66+
"name": "Pod with runAsNonRoot set true in PodSecurityContext and runAsNonRoot not set in ContainerSecurityContext and allowPreviligeEscalation set to false is allowed",
67+
"template": "pod.yaml",
68+
"expected": "pass",
69+
"field_change_list": [
70+
"spec.securityContext.runAsNonRoot=true",
71+
"spec.containers.[0].securityContext.allowPrivilegeEscalation=false"
72+
]
73+
},
74+
{
75+
"name": "Pod with runAsUser set to non-zero value in PodSecurityContext and runAsUser not set in ContainerSecurityContext and allowPreviligeEscalation set to false is allowed",
76+
"template": "pod.yaml",
77+
"expected": "pass",
78+
"field_change_list": [
79+
"spec.securityContext.runAsNonRoot=true",
80+
"spec.containers.[0].securityContext.allowPrivilegeEscalation=false"
81+
]
82+
},
83+
{
84+
"name": "Pod with runAsNonRoot set true in PodSecurityContext and runAsNonRoot set to false and runAsUser not set in ContainerSecurityContext and allowPreviligeEscalation set to false is denied",
85+
"template": "pod.yaml",
86+
"expected": "fail",
87+
"field_change_list": [
88+
"spec.securityContext.runAsNonRoot=true",
89+
"spec.containers.[0].securityContext.runAsNonRoot=false",
90+
"spec.containers.[0].securityContext.allowPrivilegeEscalation=false"
91+
]
92+
},
93+
{
94+
"name": "Deployment with PodSecurityContext not set and allowPreviligeEscalation not set in atleast one ContainerSecurityContext is blocked",
95+
"template": "deployment.yaml",
96+
"expected": "fail",
97+
"field_change_list": [
98+
]
99+
},
100+
{
101+
"name": "Deployment with PodSecurityContext not set and ContainerSecurityContext runAsUser is non-zero and allowPreviligeEscalation set to false is allowed",
102+
"template": "deployment.yaml",
103+
"expected": "pass",
104+
"field_change_list": [
105+
"spec.template.spec.containers.[0].securityContext.runAsUser=100",
106+
"spec.template.spec.containers.[0].securityContext.allowPrivilegeEscalation=false"
107+
]
108+
},
109+
{
110+
"name": "Deployment with PodSecurityContext not set and ContainerSecurityContext runAsNonRoot set to true and allowPreviligeEscalation set to false is allowed",
111+
"template": "deployment.yaml",
112+
"expected": "pass",
113+
"field_change_list": [
114+
"spec.template.spec.containers.[0].securityContext.runAsNonRoot=true",
115+
"spec.template.spec.containers.[0].securityContext.allowPrivilegeEscalation=false"
116+
]
117+
},
118+
{
119+
"name": "Deployment with PodSecurityContext not set and ContainerSecurityContext runAsUser is non-zero, runAsNonRoot set to true and allowPreviligeEscalation set to false is allowed",
120+
"template": "deployment.yaml",
121+
"expected": "pass",
122+
"field_change_list": [
123+
"spec.template.spec.containers.[0].securityContext.runAsNonRoot=true",
124+
"spec.template.spec.containers.[0].securityContext.runAsUser=100",
125+
"spec.template.spec.containers.[0].securityContext.allowPrivilegeEscalation=false"
126+
]
127+
},
128+
{
129+
"name": "Deployment with PodSecurityContext not set and ContainerSecurityContext runAsUser is non-zero and allowPreviligeEscalation set to true is denied",
130+
"template": "deployment.yaml",
131+
"expected": "fail",
132+
"field_change_list": [
133+
"spec.template.spec.containers.[0].securityContext.runAsUser=100",
134+
"spec.template.spec.containers.[0].securityContext.allowPrivilegeEscalation=true"
135+
]
136+
},
137+
{
138+
"name": "Deployment with PodSecurityContext not set and ContainerSecurityContext runAsNonRoot set to true and allowPreviligeEscalation set to true is denied",
139+
"template": "deployment.yaml",
140+
"expected": "fail",
141+
"field_change_list": [
142+
"spec.template.spec.containers.[0].securityContext.runAsNonRoot=true",
143+
"spec.template.spec.containers.[0].securityContext.allowPrivilegeEscalation=true"
144+
]
145+
},
146+
{
147+
"name": "Deployment with PodSecurityContext not set and ContainerSecurityContext runAsUser is non-zero, runAsNonRoot set to true and allowPreviligeEscalation set to true is denied",
148+
"template": "deployment.yaml",
149+
"expected": "fail",
150+
"field_change_list": [
151+
"spec.template.spec.containers.[0].securityContext.runAsNonRoot=true",
152+
"spec.template.spec.containers.[0].securityContext.runAsUser=100",
153+
"spec.template.spec.containers.[0].securityContext.allowPrivilegeEscalation=true"
154+
]
155+
},
156+
{
157+
"name": "Deployment with runAsNonRoot set true in PodSecurityContext and runAsNonRoot not set in ContainerSecurityContext and allowPreviligeEscalation set to false is allowed",
158+
"template": "deployment.yaml",
159+
"expected": "pass",
160+
"field_change_list": [
161+
"spec.template.spec.securityContext.runAsNonRoot=true",
162+
"spec.template.spec.containers.[0].securityContext.allowPrivilegeEscalation=false"
163+
]
164+
},
165+
{
166+
"name": "Deployment with runAsUser set to non-zero value in PodSecurityContext and runAsUser not set in ContainerSecurityContext and allowPreviligeEscalation set to false is allowed",
167+
"template": "deployment.yaml",
168+
"expected": "pass",
169+
"field_change_list": [
170+
"spec.template.spec.securityContext.runAsNonRoot=true",
171+
"spec.template.spec.containers.[0].securityContext.allowPrivilegeEscalation=false"
172+
]
173+
},
174+
{
175+
"name": "Deployment with runAsNonRoot set true in PodSecurityContext and runAsNonRoot set to false and runAsUser not set in ContainerSecurityContext and allowPreviligeEscalation set to false is denied",
176+
"template": "deployment.yaml",
177+
"expected": "fail",
178+
"field_change_list": [
179+
"spec.template.spec.securityContext.runAsNonRoot=true",
180+
"spec.template.spec.containers.[0].securityContext.runAsNonRoot=false",
181+
"spec.template.spec.containers.[0].securityContext.allowPrivilegeEscalation=false"
182+
]
183+
}
184+
]

0 commit comments

Comments
 (0)