Skip to content

Commit ff4b59f

Browse files
YiscahLevySilas1YiscahLevySilas1
committed
add rules host-pid-privileges and host-ipc-privileges
Signed-off-by: YiscahLevySilas1 <[email protected]>
1 parent 8e83c4a commit ff4b59f

File tree

16 files changed

+543
-0
lines changed

16 files changed

+543
-0
lines changed

‎rules/host-ipc-privileges/raw.rego

+68
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
package armo_builtins
2+
3+
4+
# Fails if pod has hostIPC enabled
5+
deny[msga] {
6+
pod := input[_]
7+
pod.kind == "Pod"
8+
is_host_ipc(pod.spec)
9+
path := "spec.hostIPC"
10+
msga := {
11+
"alertMessage": sprintf("Pod: %v has hostIPC enabled", [pod.metadata.name]),
12+
"packagename": "armo_builtins",
13+
"alertScore": 7,
14+
"deletePaths": [path],
15+
"failedPaths": [path],
16+
"fixPaths": [],
17+
"alertObject": {
18+
"k8sApiObjects": [pod]
19+
}
20+
}
21+
}
22+
23+
24+
# Fails if workload has hostIPC enabled
25+
deny[msga] {
26+
wl := input[_]
27+
spec_template_spec_patterns := {"Deployment","ReplicaSet","DaemonSet","StatefulSet","Job"}
28+
is_host_ipc(wl.spec.template.spec)
29+
path := "spec.template.spec.hostIPC"
30+
msga := {
31+
"alertMessage": sprintf("%v: %v has a pod with hostIPC enabled", [wl.kind, wl.metadata.name]),
32+
"alertScore": 9,
33+
"deletePaths": [path],
34+
"failedPaths": [path],
35+
"fixPaths": [],
36+
"packagename": "armo_builtins",
37+
"alertObject": {
38+
"k8sApiObjects": [wl]
39+
}
40+
}
41+
}
42+
43+
44+
# Fails if cronjob has hostIPC enabled
45+
deny[msga] {
46+
wl := input[_]
47+
wl.kind == "CronJob"
48+
is_host_ipc(wl.spec.jobTemplate.spec.template.spec)
49+
path := "spec.jobTemplate.spec.template.spec.hostIPC"
50+
msga := {
51+
"alertMessage": sprintf("CronJob: %v has a pod with hostIPC enabled", [wl.metadata.name]),
52+
"alertScore": 9,
53+
"deletePaths": [path],
54+
"failedPaths": [path],
55+
"fixPaths": [],
56+
"packagename": "armo_builtins",
57+
"alertObject": {
58+
"k8sApiObjects": [wl]
59+
}
60+
}
61+
}
62+
63+
# Check that hostIPC is set to false. Default is false. Only in pod spec
64+
65+
66+
is_host_ipc(podspec){
67+
podspec.hostIPC == true
68+
}

‎rules/host-ipc-privileges/rule.metadata.json

+50
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
{
2+
"name": "host-ipc-privileges",
3+
"attributes": {
4+
},
5+
"ruleLanguage": "Rego",
6+
"match": [
7+
{
8+
"apiGroups": [
9+
""
10+
],
11+
"apiVersions": [
12+
"v1"
13+
],
14+
"resources": [
15+
"Pod"
16+
]
17+
},
18+
{
19+
"apiGroups": [
20+
"apps"
21+
],
22+
"apiVersions": [
23+
"v1"
24+
],
25+
"resources": [
26+
"Deployment",
27+
"ReplicaSet",
28+
"DaemonSet",
29+
"StatefulSet"
30+
]
31+
},
32+
{
33+
"apiGroups": [
34+
"batch"
35+
],
36+
"apiVersions": [
37+
"*"
38+
],
39+
"resources": [
40+
"Job",
41+
"CronJob"
42+
]
43+
}
44+
],
45+
"ruleDependencies": [
46+
],
47+
"description": "Containers should be as isolated as possible from the host machine. The hostIPC field in Kubernetes may excessively expose the host to potentially malicious actions.",
48+
"remediation": "Make sure that the field hostIPC in the pod spec is not set to true (set to false or not present)",
49+
"ruleQuery": "armo_builtins"
50+
}

‎rules/host-ipc-privileges/test/cronjob/expected.json

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
[{
2+
"alertMessage": "CronJob: hello has a pod with hostIPC enabled",
3+
"deletePaths": ["spec.jobTemplate.spec.template.spec.hostIPC"],
4+
"failedPaths": ["spec.jobTemplate.spec.template.spec.hostIPC"],
5+
"fixPaths": [],
6+
"ruleStatus": "",
7+
"packagename": "armo_builtins",
8+
"alertScore": 9,
9+
"alertObject": {
10+
"k8sApiObjects": [{
11+
"apiVersion": "batch/v1beta1",
12+
"kind": "CronJob",
13+
"metadata": {
14+
"name": "hello"
15+
}
16+
}]
17+
}
18+
}]

‎rules/host-ipc-privileges/test/cronjob/input/cronjob.yaml

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
apiVersion: batch/v1beta1
2+
kind: CronJob
3+
metadata:
4+
name: hello
5+
spec:
6+
schedule: "*/1 * * * *"
7+
jobTemplate:
8+
spec:
9+
template:
10+
spec :
11+
hostIPC: true
12+
hostPID: false
13+
containers :
14+
-
15+
name : mysql
16+
image : mysql
17+
env :
18+
-
19+
name : MYSQL_ROOT_PASSWORD
20+
value : "rootpasswd"
21+
volumeMounts :
22+
-
23+
mountPath : /var/lib/mysql
24+
name : site-data
25+
subPath : mysql
26+
-
27+
name : php
28+
image : php:7.0-apache
29+
volumeMounts :
30+
-
31+
mountPath : /var/www/html
32+
name : site-data
33+
subPath : html
34+
volumes :
35+
-
36+
name : site-data
37+
persistentVolumeClaim :
38+
claimName : my-lamp-site-data
39+
restartPolicy: OnFailure
40+

‎rules/host-ipc-privileges/test/pod/expected.json

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
[{
2+
"alertMessage": "Pod: test has hostIPC enabled",
3+
"deletePaths": ["spec.hostIPC"],
4+
"failedPaths": ["spec.hostIPC"],
5+
"fixPaths": [],
6+
"ruleStatus": "",
7+
"packagename": "armo_builtins",
8+
"alertScore": 7,
9+
"alertObject": {
10+
"k8sApiObjects": [{
11+
"apiVersion": "v1",
12+
"kind": "Pod",
13+
"metadata": {
14+
"name": "test"
15+
}
16+
}]
17+
}
18+
}]

‎rules/host-ipc-privileges/test/pod/input/pod.yaml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: v1
2+
kind: Pod
3+
metadata:
4+
name: test
5+
spec:
6+
containers:
7+
- args:
8+
- server
9+
env:
10+
- name: BASE_HREF
11+
value: /argo/
12+
image: test:latest
13+
name: test
14+
- name : test2
15+
image : test
16+
hostNetwork: true
17+
hostIPC: true

‎rules/host-ipc-privileges/test/workload/expected.json

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
[ {
2+
"alertMessage": "Deployment: my-deployment has a pod with hostIPC enabled",
3+
"deletePaths": ["spec.template.spec.hostIPC"],
4+
"failedPaths": ["spec.template.spec.hostIPC"],
5+
"fixPaths": [],
6+
"ruleStatus": "",
7+
"packagename": "armo_builtins",
8+
"alertScore": 9,
9+
"alertObject": {
10+
"k8sApiObjects": [{
11+
"apiVersion": "apps/v1",
12+
"kind": "Deployment",
13+
"metadata": {
14+
"labels": {
15+
"app": "goproxy"
16+
},
17+
"name": "my-deployment"
18+
}
19+
}]
20+
}
21+
}]

‎rules/host-ipc-privileges/test/workload/input/deployment.yaml

+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: my-deployment
5+
labels:
6+
app : goproxy
7+
spec:
8+
selector:
9+
matchLabels:
10+
app : goproxy
11+
template:
12+
metadata :
13+
name : goproxy
14+
labels :
15+
app : goproxy
16+
spec :
17+
hostIPC: true
18+
hostPID: true
19+
containers :
20+
-
21+
name : mysql
22+
image : mysql
23+
env :
24+
-
25+
name : MYSQL_ROOT_PASSWORD
26+
value : "rootpasswd"
27+
-
28+
name : php
29+
image : php:7.0-apache
30+
volumeMounts :
31+
-
32+
mountPath : /var/www/html
33+
name : site-data
34+
subPath : html
35+
volumes :
36+
-
37+
name : site-data
38+
persistentVolumeClaim :
39+
claimName : my-lamp-site-data

‎rules/host-pid-privileges/raw.rego

+70
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
package armo_builtins
2+
3+
4+
# Fails if pod has hostPID enabled
5+
deny[msga] {
6+
pod := input[_]
7+
pod.kind == "Pod"
8+
is_host_pid(pod.spec)
9+
path := "spec.hostPID"
10+
msga := {
11+
"alertMessage": sprintf("Pod: %v has hostPID enabled", [pod.metadata.name]),
12+
"packagename": "armo_builtins",
13+
"alertScore": 7,
14+
"deletePaths": [path],
15+
"failedPaths": [path],
16+
"fixPaths": [],
17+
"alertObject": {
18+
"k8sApiObjects": [pod]
19+
}
20+
}
21+
}
22+
23+
24+
# Fails if workload has hostPID enabled
25+
deny[msga] {
26+
wl := input[_]
27+
spec_template_spec_patterns := {"Deployment","ReplicaSet","DaemonSet","StatefulSet","Job"}
28+
is_host_pid(wl.spec.template.spec)
29+
path := "spec.template.spec.hostPID"
30+
msga := {
31+
"alertMessage": sprintf("%v: %v has a pod with hostPID enabled", [wl.kind, wl.metadata.name]),
32+
"alertScore": 9,
33+
"deletePaths": [path],
34+
"failedPaths": [path],
35+
"fixPaths": [],
36+
"packagename": "armo_builtins",
37+
"alertObject": {
38+
"k8sApiObjects": [wl]
39+
}
40+
}
41+
}
42+
43+
44+
# Fails if cronjob has hostPID enabled
45+
deny[msga] {
46+
wl := input[_]
47+
wl.kind == "CronJob"
48+
is_host_pid(wl.spec.jobTemplate.spec.template.spec)
49+
path := "spec.jobTemplate.spec.template.spec.hostPID"
50+
msga := {
51+
"alertMessage": sprintf("CronJob: %v has a pod with hostPID enabled", [wl.metadata.name]),
52+
"alertScore": 9,
53+
"deletePaths": [path],
54+
"failedPaths": [path],
55+
"fixPaths": [],
56+
"packagename": "armo_builtins",
57+
"alertObject": {
58+
"k8sApiObjects": [wl]
59+
}
60+
}
61+
}
62+
63+
64+
65+
# Check that hostPID and are set to false. Default is false. Only in pod spec
66+
67+
68+
is_host_pid(podspec){
69+
podspec.hostPID == true
70+
}

0 commit comments

Comments
 (0)