diff --git a/checks/insecureCapabilities.yaml b/checks/insecureCapabilities.yaml index 28951f76..8f6b1713 100644 --- a/checks/insecureCapabilities.yaml +++ b/checks/insecureCapabilities.yaml @@ -53,5 +53,4 @@ schema: - contains: const: KILL - contains: - const: AUDIT_WRITE - + const: AUDIT_WRITE \ No newline at end of file diff --git a/checks/privilegeEscalationAllowed.yaml b/checks/privilegeEscalationAllowed.yaml index 5c72a35a..8d2933d9 100644 --- a/checks/privilegeEscalationAllowed.yaml +++ b/checks/privilegeEscalationAllowed.yaml @@ -2,15 +2,42 @@ successMessage: Privilege escalation not allowed failureMessage: Privilege escalation should not be allowed category: Security target: Container +schemaTarget: Pod schema: '$schema': http://json-schema.org/draft-07/schema - type: object - required: - - securityContext - properties: - securityContext: - required: - - allowPrivilegeEscalation + definitions: + goodSecurityContext: + type: object + anyOf: + - required: + - allowPrivilegeEscalation + properties: + allowPrivilegeEscalation: + const: false + notBadSecurityContext: + type: object properties: allowPrivilegeEscalation: const: false + type: object + anyOf: + - required: + - securityContext + properties: + securityContext: + $ref: "#/definitions/goodSecurityContext" + containers: + type: array + items: + properties: + securityContext: + $ref: "#/definitions/notBadSecurityContext" + - properties: + containers: + type: array + items: + required: + - securityContext + properties: + securityContext: + $ref: "#/definitions/goodSecurityContext" \ No newline at end of file diff --git a/checks/runAsPrivileged.yaml b/checks/runAsPrivileged.yaml index 47be7cb7..a0f77169 100644 --- a/checks/runAsPrivileged.yaml +++ b/checks/runAsPrivileged.yaml @@ -2,12 +2,23 @@ successMessage: Not running as privileged failureMessage: Should not be running as privileged category: Security target: Container +schemaTarget: Pod schema: '$schema': http://json-schema.org/draft-07/schema - type: object - properties: - securityContext: + definitions: + notBadSecurityContext: + type: object properties: privileged: not: const: true + type: object + properties: + securityContext: + $ref: "#/definitions/notBadSecurityContext" + containers: + type: array + items: + properties: + securityContext: + $ref: "#/definitions/notBadSecurityContext" \ No newline at end of file diff --git a/test/checks/insecureCapabilities/failure.pod.yaml b/test/checks/insecureCapabilities/failure.pod.yaml new file mode 100644 index 00000000..72ecbbf8 --- /dev/null +++ b/test/checks/insecureCapabilities/failure.pod.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Pod +metadata: + name: nginx + labels: + env: test +spec: + securityContext: + capabilities: + drop: + - ALL + containers: + - name: nginx + image: nginx + diff --git a/test/checks/insecureCapabilities/success.pod.yaml b/test/checks/insecureCapabilities/success.pod.yaml new file mode 100644 index 00000000..6c7c391a --- /dev/null +++ b/test/checks/insecureCapabilities/success.pod.yaml @@ -0,0 +1,31 @@ +apiVersion: v1 +kind: Pod +metadata: + name: nginx + labels: + env: test +spec: + securityContext: + capabilities: + drop: + containers: + - name: nginx + image: nginx + securityContext: + capabilities: + drop: + - NET_ADMIN + - CHOWN + - DAC_OVERRIDE + - FSETID + - FOWNER + - MKNOD + - NET_RAW + - SETGID + - SETUID + - SETFCAP + - SETPCAP + - NET_BIND_SERVICE + - SYS_CHROOT + - KILL + - AUDIT_WRITE diff --git a/test/checks/privilegeEscalationAllowed/failure.pod.yaml b/test/checks/privilegeEscalationAllowed/failure.pod.yaml new file mode 100644 index 00000000..882cf95d --- /dev/null +++ b/test/checks/privilegeEscalationAllowed/failure.pod.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Pod +metadata: + name: nginx + labels: + env: test +spec: + securityContext: + allowPrivilegeEscalation: false + containers: + - name: nginx + image: nginx + securityContext: + allowPrivilegeEscalation: true \ No newline at end of file diff --git a/test/checks/privilegeEscalationAllowed/failure.pod_unspecified.yaml b/test/checks/privilegeEscalationAllowed/failure.pod_unspecified.yaml new file mode 100644 index 00000000..4d5c15a2 --- /dev/null +++ b/test/checks/privilegeEscalationAllowed/failure.pod_unspecified.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: Pod +metadata: + name: nginx + labels: + env: test +spec: + securityContext: + allowPrivilegeEscalation: false + containers: + - name: nginx + image: nginx + securityContext: \ No newline at end of file diff --git a/test/checks/privilegeEscalationAllowed/success.pod.yaml b/test/checks/privilegeEscalationAllowed/success.pod.yaml new file mode 100644 index 00000000..b497a7d4 --- /dev/null +++ b/test/checks/privilegeEscalationAllowed/success.pod.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Pod +metadata: + name: nginx + labels: + env: test +spec: + securityContext: + allowPrivilegeEscalation: true + containers: + - name: nginx + image: nginx + securityContext: + allowPrivilegeEscalation: false \ No newline at end of file diff --git a/test/checks/runAsPrivileged/failure.pod.yaml b/test/checks/runAsPrivileged/failure.pod.yaml new file mode 100644 index 00000000..15e2259f --- /dev/null +++ b/test/checks/runAsPrivileged/failure.pod.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: Pod +metadata: + name: nginx + labels: + env: test +spec: + securityContext: + privileged: false + containers: + - securityContext: + privileged: true \ No newline at end of file diff --git a/test/checks/runAsPrivileged/failure.two_cont.yaml b/test/checks/runAsPrivileged/failure.two_cont.yaml new file mode 100644 index 00000000..e510773a --- /dev/null +++ b/test/checks/runAsPrivileged/failure.two_cont.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Pod +metadata: + name: nginx + labels: + env: test +spec: + securityContext: + privileged: false + containers: + - securityContext: + privileged: true + - securityContext: + privileged: false \ No newline at end of file diff --git a/test/checks/runAsPrivileged/failure.two_cont_one_unspecified.yaml b/test/checks/runAsPrivileged/failure.two_cont_one_unspecified.yaml new file mode 100644 index 00000000..1ec68c5b --- /dev/null +++ b/test/checks/runAsPrivileged/failure.two_cont_one_unspecified.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: Pod +metadata: + name: nginx + labels: + env: test +spec: + securityContext: + privileged: false + containers: + - securityContext: + privileged: true + - securityContext: \ No newline at end of file diff --git a/test/checks/runAsPrivileged/success.pod.yaml b/test/checks/runAsPrivileged/success.pod.yaml new file mode 100644 index 00000000..a66f1955 --- /dev/null +++ b/test/checks/runAsPrivileged/success.pod.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: Pod +metadata: + name: nginx + labels: + env: test +spec: + securityContext: + privileged: true + containers: + - securityContext: + privileged: false diff --git a/test/checks/runAsPrivileged/success.pod_no_cont.yaml b/test/checks/runAsPrivileged/success.pod_no_cont.yaml new file mode 100644 index 00000000..9a12d629 --- /dev/null +++ b/test/checks/runAsPrivileged/success.pod_no_cont.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: Pod +metadata: + name: nginx + labels: + env: test +spec: + securityContext: + privileged: false + containers: + - securityContext: +