Skip to content

Commit e195524

Browse files
YiscahLevySilas1YiscahLevySilas1
authored
add 2 new controls for 5.2.3, 5.2.4 (#655)
* add rules host-pid-privileges and host-ipc-privileges Signed-off-by: YiscahLevySilas1 <[email protected]> * add controls C-0275, C-0276 for cis-1.10 Signed-off-by: YiscahLevySilas1 <[email protected]> * update upload-artifact to v4 Signed-off-by: YiscahLevySilas1 <[email protected]> --------- Signed-off-by: YiscahLevySilas1 <[email protected]>
1 parent 8e83c4a commit e195524

21 files changed

+602
-3
lines changed

‎.github/workflows/create-release-v2.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ jobs:
8181
echo "REGO_ARTIFACT_PATH=${{ env.REGO_ARTIFACT_PATH }}" >> $GITHUB_OUTPUT
8282
8383
- name: Upload artifact
84-
uses: actions/upload-artifact@v3
84+
uses: actions/upload-artifact@v4
8585
with:
8686
name: ${{ env.REGO_ARTIFACT_KEY_NAME }}
8787
path: ${{ env.REGO_ARTIFACT_PATH }}/

‎.github/workflows/pr-tests.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,7 @@ jobs:
101101
echo "REGO_ARTIFACT_KEY_NAME=${{ env.REGO_ARTIFACT_KEY_NAME }}" >> $GITHUB_OUTPUT
102102
echo "REGO_ARTIFACT_PATH=${{ env.REGO_ARTIFACT_PATH }}" >> $GITHUB_OUTPUT
103103
104-
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # ratchet:actions/[email protected]
104+
- uses: actions/upload-artifact@v4
105105
name: Upload artifact
106106
with:
107107
name: ${{ env.REGO_ARTIFACT_KEY_NAME }}

‎.github/workflows/scorecard.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ jobs:
5959
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
6060
# format to the repository Actions tab.
6161
- name: "Upload artifact"
62-
uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # v3.1.0
62+
uses: actions/upload-artifact@v4
6363
with:
6464
name: SARIF file
6565
path: results.sarif

‎controls/C-0275-minimizetheadmissionofcontainerswishingtosharethehostprocessidnamespace.json

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
{
2+
"controlID": "C-0275",
3+
"name": "Minimize the admission of containers wishing to share the host process ID namespace",
4+
"description": "Do not generally permit containers to be run with the hostPID flag set to true.",
5+
"long_description": "A container running in the host's PID namespace can inspect processes running outside the container. If the container also has access to ptrace capabilities this can be used to escalate privileges outside of the container.\n\n There should be at least one admission control policy defined which does not permit containers to share the host PID namespace.\n\n If you need to run containers which require hostPID, this should be defined in a separate policy and you should carefully check to ensure that only limited service accounts and users are given permission to use that policy.",
6+
"remediation": "Configure the Admission Controller to restrict the admission of `hostPID` containers.",
7+
"manual_test": "Fetch hostPID from each pod with\n\n \n```\nget pods -A -o=jsonpath=$'{range .items[*]}{@.metadata.name}: {@.spec.hostPID}\n{end}'\n```",
8+
"references": [
9+
"https://workbench.cisecurity.org/sections/2633390/recommendations/4261968"
10+
],
11+
"attributes": {
12+
},
13+
"rulesNames": [
14+
"host-pid-privileges"
15+
],
16+
"baseScore": 5,
17+
"impact_statement": "Pods defined with `spec.hostPID: true` will not be permitted unless they are run under a specific policy.",
18+
"default_value": "By default, there are no restrictions on the creation of `hostPID` containers.",
19+
"category": {
20+
"name" : "Workload"
21+
},
22+
"scanningScope": {
23+
"matches": [
24+
"cluster",
25+
"file"
26+
]
27+
}
28+
}

‎controls/C-0276-minimizetheadmissionofcontainerswishingtosharethehostipcnamespace.json

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
{
2+
"controlID": "C-0276",
3+
"name": "Minimize the admission of containers wishing to share the host IPC namespace",
4+
"description": "Do not generally permit containers to be run with the hostIPC flag set to true.",
5+
"long_description": "A container running in the host's IPC namespace can use IPC to interact with processes outside the container.\n\n There should be at least one admission control policy defined which does not permit containers to share the host IPC namespace.\n\n If you need to run containers which require hostIPC, this should be definited in a separate policy and you should carefully check to ensure that only limited service accounts and users are given permission to use that policy.",
6+
"remediation": "Add policies to each namespace in the cluster which has user workloads to restrict the admission of `hostIPC` containers.",
7+
"manual_test": "To fetch hostIPC from each pod.\n\n```\nget pods -A -o=jsonpath=$'{range .items[*]}{@.metadata.name}: {@.spec.hostIPC}\n{end}'\n```",
8+
"references": [
9+
"https://workbench.cisecurity.org/sections/2633390/recommendations/4261969"
10+
],
11+
"attributes": {
12+
},
13+
"rulesNames": [
14+
"host-ipc-privileges"
15+
],
16+
"baseScore": 5,
17+
"impact_statement": "Pods defined with `spec.hostIPC: true` will not be permitted unless they are run under a specific policy.",
18+
"default_value": "By default, there are no restrictions on the creation of `hostIPC` containers.",
19+
"category": {
20+
"name" : "Workload"
21+
},
22+
"scanningScope": {
23+
"matches": [
24+
"cluster",
25+
"file"
26+
]
27+
}
28+
}

‎rules/host-ipc-privileges/raw.rego

+68
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
package armo_builtins
2+
3+
4+
# Fails if pod has hostIPC enabled
5+
deny[msga] {
6+
pod := input[_]
7+
pod.kind == "Pod"
8+
is_host_ipc(pod.spec)
9+
path := "spec.hostIPC"
10+
msga := {
11+
"alertMessage": sprintf("Pod: %v has hostIPC enabled", [pod.metadata.name]),
12+
"packagename": "armo_builtins",
13+
"alertScore": 7,
14+
"deletePaths": [path],
15+
"failedPaths": [path],
16+
"fixPaths": [],
17+
"alertObject": {
18+
"k8sApiObjects": [pod]
19+
}
20+
}
21+
}
22+
23+
24+
# Fails if workload has hostIPC enabled
25+
deny[msga] {
26+
wl := input[_]
27+
spec_template_spec_patterns := {"Deployment","ReplicaSet","DaemonSet","StatefulSet","Job"}
28+
is_host_ipc(wl.spec.template.spec)
29+
path := "spec.template.spec.hostIPC"
30+
msga := {
31+
"alertMessage": sprintf("%v: %v has a pod with hostIPC enabled", [wl.kind, wl.metadata.name]),
32+
"alertScore": 9,
33+
"deletePaths": [path],
34+
"failedPaths": [path],
35+
"fixPaths": [],
36+
"packagename": "armo_builtins",
37+
"alertObject": {
38+
"k8sApiObjects": [wl]
39+
}
40+
}
41+
}
42+
43+
44+
# Fails if cronjob has hostIPC enabled
45+
deny[msga] {
46+
wl := input[_]
47+
wl.kind == "CronJob"
48+
is_host_ipc(wl.spec.jobTemplate.spec.template.spec)
49+
path := "spec.jobTemplate.spec.template.spec.hostIPC"
50+
msga := {
51+
"alertMessage": sprintf("CronJob: %v has a pod with hostIPC enabled", [wl.metadata.name]),
52+
"alertScore": 9,
53+
"deletePaths": [path],
54+
"failedPaths": [path],
55+
"fixPaths": [],
56+
"packagename": "armo_builtins",
57+
"alertObject": {
58+
"k8sApiObjects": [wl]
59+
}
60+
}
61+
}
62+
63+
# Check that hostIPC is set to false. Default is false. Only in pod spec
64+
65+
66+
is_host_ipc(podspec){
67+
podspec.hostIPC == true
68+
}

‎rules/host-ipc-privileges/rule.metadata.json

+50
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
{
2+
"name": "host-ipc-privileges",
3+
"attributes": {
4+
},
5+
"ruleLanguage": "Rego",
6+
"match": [
7+
{
8+
"apiGroups": [
9+
""
10+
],
11+
"apiVersions": [
12+
"v1"
13+
],
14+
"resources": [
15+
"Pod"
16+
]
17+
},
18+
{
19+
"apiGroups": [
20+
"apps"
21+
],
22+
"apiVersions": [
23+
"v1"
24+
],
25+
"resources": [
26+
"Deployment",
27+
"ReplicaSet",
28+
"DaemonSet",
29+
"StatefulSet"
30+
]
31+
},
32+
{
33+
"apiGroups": [
34+
"batch"
35+
],
36+
"apiVersions": [
37+
"*"
38+
],
39+
"resources": [
40+
"Job",
41+
"CronJob"
42+
]
43+
}
44+
],
45+
"ruleDependencies": [
46+
],
47+
"description": "Containers should be as isolated as possible from the host machine. The hostIPC field in Kubernetes may excessively expose the host to potentially malicious actions.",
48+
"remediation": "Make sure that the field hostIPC in the pod spec is not set to true (set to false or not present)",
49+
"ruleQuery": "armo_builtins"
50+
}

‎rules/host-ipc-privileges/test/cronjob/expected.json

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
[{
2+
"alertMessage": "CronJob: hello has a pod with hostIPC enabled",
3+
"deletePaths": ["spec.jobTemplate.spec.template.spec.hostIPC"],
4+
"failedPaths": ["spec.jobTemplate.spec.template.spec.hostIPC"],
5+
"fixPaths": [],
6+
"ruleStatus": "",
7+
"packagename": "armo_builtins",
8+
"alertScore": 9,
9+
"alertObject": {
10+
"k8sApiObjects": [{
11+
"apiVersion": "batch/v1beta1",
12+
"kind": "CronJob",
13+
"metadata": {
14+
"name": "hello"
15+
}
16+
}]
17+
}
18+
}]

‎rules/host-ipc-privileges/test/cronjob/input/cronjob.yaml

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
apiVersion: batch/v1beta1
2+
kind: CronJob
3+
metadata:
4+
name: hello
5+
spec:
6+
schedule: "*/1 * * * *"
7+
jobTemplate:
8+
spec:
9+
template:
10+
spec :
11+
hostIPC: true
12+
hostPID: false
13+
containers :
14+
-
15+
name : mysql
16+
image : mysql
17+
env :
18+
-
19+
name : MYSQL_ROOT_PASSWORD
20+
value : "rootpasswd"
21+
volumeMounts :
22+
-
23+
mountPath : /var/lib/mysql
24+
name : site-data
25+
subPath : mysql
26+
-
27+
name : php
28+
image : php:7.0-apache
29+
volumeMounts :
30+
-
31+
mountPath : /var/www/html
32+
name : site-data
33+
subPath : html
34+
volumes :
35+
-
36+
name : site-data
37+
persistentVolumeClaim :
38+
claimName : my-lamp-site-data
39+
restartPolicy: OnFailure
40+

‎rules/host-ipc-privileges/test/pod/expected.json

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
[{
2+
"alertMessage": "Pod: test has hostIPC enabled",
3+
"deletePaths": ["spec.hostIPC"],
4+
"failedPaths": ["spec.hostIPC"],
5+
"fixPaths": [],
6+
"ruleStatus": "",
7+
"packagename": "armo_builtins",
8+
"alertScore": 7,
9+
"alertObject": {
10+
"k8sApiObjects": [{
11+
"apiVersion": "v1",
12+
"kind": "Pod",
13+
"metadata": {
14+
"name": "test"
15+
}
16+
}]
17+
}
18+
}]

‎rules/host-ipc-privileges/test/pod/input/pod.yaml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: v1
2+
kind: Pod
3+
metadata:
4+
name: test
5+
spec:
6+
containers:
7+
- args:
8+
- server
9+
env:
10+
- name: BASE_HREF
11+
value: /argo/
12+
image: test:latest
13+
name: test
14+
- name : test2
15+
image : test
16+
hostNetwork: true
17+
hostIPC: true

‎rules/host-ipc-privileges/test/workload/expected.json

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
[ {
2+
"alertMessage": "Deployment: my-deployment has a pod with hostIPC enabled",
3+
"deletePaths": ["spec.template.spec.hostIPC"],
4+
"failedPaths": ["spec.template.spec.hostIPC"],
5+
"fixPaths": [],
6+
"ruleStatus": "",
7+
"packagename": "armo_builtins",
8+
"alertScore": 9,
9+
"alertObject": {
10+
"k8sApiObjects": [{
11+
"apiVersion": "apps/v1",
12+
"kind": "Deployment",
13+
"metadata": {
14+
"labels": {
15+
"app": "goproxy"
16+
},
17+
"name": "my-deployment"
18+
}
19+
}]
20+
}
21+
}]

‎rules/host-ipc-privileges/test/workload/input/deployment.yaml

+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: my-deployment
5+
labels:
6+
app : goproxy
7+
spec:
8+
selector:
9+
matchLabels:
10+
app : goproxy
11+
template:
12+
metadata :
13+
name : goproxy
14+
labels :
15+
app : goproxy
16+
spec :
17+
hostIPC: true
18+
hostPID: true
19+
containers :
20+
-
21+
name : mysql
22+
image : mysql
23+
env :
24+
-
25+
name : MYSQL_ROOT_PASSWORD
26+
value : "rootpasswd"
27+
-
28+
name : php
29+
image : php:7.0-apache
30+
volumeMounts :
31+
-
32+
mountPath : /var/www/html
33+
name : site-data
34+
subPath : html
35+
volumes :
36+
-
37+
name : site-data
38+
persistentVolumeClaim :
39+
claimName : my-lamp-site-data

0 commit comments

Comments
 (0)