github/polaris
1
0
Fork 0
mirror of https://github.com/FairwindsOps/polaris.git synced 2026-05-14 05:06:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix checks for k8s defaults (#496)

Browse Source 
* fix insecure caps check

* add more tests

* fix privilege escalation allowed
This commit is contained in:
Robert Brennan
2021-02-11 17:11:16 -05:00
committed by GitHub
parent 38b5cd8193
commit c16aac808f
10 changed files with 172 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

58
checks/insecureCapabilities.yaml
View File

@@ -5,27 +5,53 @@ target: Container
schema:
'$schema': http://json-schema.org/draft-07/schema
type: object
required:
- securityContext
properties:
securityContext:
type: object
required:
- capabilities
properties:
capabilities:
type: object
required:
- drop
properties:
add:
enum:
- CHOWN
- DAC_OVERRIDE
- FSETID
- FOWNER
- MKNOD
- NET_RAW
- SETGID
- SETUID
- SETFCAP
- SETPCAP
- NET_BIND_SERVICE
- SYS_CHROOT
- KILL
- AUDIT_WRITE
drop:
type: array
oneOf:
- contains:
const: ALL
- allOf:
- contains:
const: NET_ADMIN
- contains:
const: CHOWN
- contains:
const: DAC_OVERRIDE
- contains:
const: FSETID
- contains:
const: FOWNER
- contains:
const: MKNOD
- contains:
const: NET_RAW
- contains:
const: SETGID
- contains:
const: SETUID
- contains:
const: SETFCAP
- contains:
const: SETPCAP
- contains:
const: NET_BIND_SERVICE
- contains:
const: SYS_CHROOT
- contains:
const: KILL
- contains:
const: AUDIT_WRITE

7
checks/privilegeEscalationAllowed.yaml
View File

@@ -5,9 +5,12 @@ target: Container
schema:
'$schema': http://json-schema.org/draft-07/schema
type: object
required:
- securityContext
properties:
securityContext:
required:
- allowPrivilegeEscalation
properties:
allowPrivilegeEscalation:
not:
const: true
const: false

16
pkg/validator/container_test.go
View File

@@ -555,14 +555,14 @@ func TestValidateSecurity(t *testing.T) {
Category: "Security",
}, {
ID: "privilegeEscalationAllowed",
Message: "Privilege escalation not allowed",
Success: true,
Message: "Privilege escalation should not be allowed",
Success: false,
Severity: "danger",
Category: "Security",
}, {
ID: "insecureCapabilities",
Message: "Container does not have any insecure capabilities",
Success: true,
Message: "Container should not have insecure capabilities",
Success: false,
Severity: "warning",
Category: "Security",
}, {
@@ -739,8 +739,8 @@ func TestValidateSecurity(t *testing.T) {
Category: "Security",
}, {
ID: "insecureCapabilities",
Message: "Container does not have any insecure capabilities",
Success: true,
Message: "Container should not have insecure capabilities",
Success: false,
Severity: "warning",
Category: "Security",
}},
@@ -758,8 +758,8 @@ func TestValidateSecurity(t *testing.T) {
Category: "Security",
}, {
ID: "insecureCapabilities",
Message: "Container does not have any insecure capabilities",
Success: true,
Message: "Container should not have insecure capabilities",
Success: false,
Severity: "danger",
Category: "Security",
}, {

29
test/checks/insecureCapabilities/failure.drop-most.yaml Normal file
View File

@@ -0,0 +1,29 @@
apiVersion: v1
kind: Pod
metadata:
name: nginx
labels:
env: test
spec:
containers:
- name: nginx
image: nginx
securityContext:
capabilities:
drop:
- NET_ADMIN
- CHOWN
- DAC_OVERRIDE
- FSETID
- FOWNER
- MKNOD
- NET_RAW
- SETGID
- SETUID
- SETFCAP
- SETPCAP
- NET_BIND_SERVICE
- SYS_CHROOT
- KILL

10
test/checks/insecureCapabilities/failure.yaml Normal file
View File

@@ -0,0 +1,10 @@
apiVersion: v1
kind: Pod
metadata:
name: nginx
labels:
env: test
spec:
containers:
- name: nginx
image: nginx

14
test/checks/insecureCapabilities/success.drop.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: v1
kind: Pod
metadata:
name: nginx
labels:
env: test
spec:
containers:
- name: nginx
image: nginx
securityContext:
capabilities:
drop:
- ALL

29
test/checks/insecureCapabilities/success.yaml Normal file
View File

@@ -0,0 +1,29 @@
apiVersion: v1
kind: Pod
metadata:
name: nginx
labels:
env: test
spec:
containers:
- name: nginx
image: nginx
securityContext:
capabilities:
drop:
- NET_ADMIN
- CHOWN
- DAC_OVERRIDE
- FSETID
- FOWNER
- MKNOD
- NET_RAW
- SETGID
- SETUID
- SETFCAP
- SETPCAP
- NET_BIND_SERVICE
- SYS_CHROOT
- KILL
- AUDIT_WRITE

10
test/checks/privilegeEscalationAllowed/failure.unspecified.yaml Normal file
View File

@@ -0,0 +1,10 @@
apiVersion: v1
kind: Pod
metadata:
name: nginx
labels:
env: test
spec:
containers:
- name: nginx
image: nginx

13
test/checks/privilegeEscalationAllowed/failure.yaml Normal file
View File

@@ -0,0 +1,13 @@
apiVersion: v1
kind: Pod
metadata:
name: nginx
labels:
env: test
spec:
containers:
- name: nginx
image: nginx
securityContext:
allowPrivilegeEscalation: true

12
test/checks/privilegeEscalationAllowed/success.yaml Normal file
View File

@@ -0,0 +1,12 @@
apiVersion: v1
kind: Pod
metadata:
name: nginx
labels:
env: test
spec:
containers:
- name: nginx
image: nginx
securityContext:
allowPrivilegeEscalation: false