mirror of
https://github.com/FairwindsOps/polaris.git
synced 2026-05-19 23:58:40 +00:00
467d06f4db
* Enable these checks in the default configuration file, which may produce many new results: * automountServiceAccountToken * linuxHardening * sensitiveConfigmapContent and sensitiveContainerEnvVar * clusterrolebindingClusterAdmin, rolebindingClusterAdminClusterRole, and rolebindingClusterAdminRole * clusterrolePodExecAttach, rolePodExecAttach, clusterrolebindingPodExecAttach, rolebindingClusterRolePodExecAttach, and rolebindingRolePodExecAttach * Ignore the `missingNetworkPolicy` and `automountServiceAccountToken` checks by default * `hasPrefix` and `hasSuffix` functions are now available in the go template * Fix the `sensitiveContainerEnvVar` check to ignore sensitive environment variable names when those variables use `valueFrom` to reference an external resource. * Add the `*ClusterAdmin` checks to `examples/config-full.yaml`. * Exempt the prefix `system:` instead of individual entries for RBAC checks (#871)
57 lines
1.7 KiB
YAML
57 lines
1.7 KiB
YAML
successMessage: The Role does not allow pods/exec or pods/attach
|
|
failureMessage: The Role allows Pods/exec or pods/attach
|
|
category: Security
|
|
target: rbac.authorization.k8s.io/Role
|
|
schemaString: |
|
|
'$schema': http://json-schema.org/draft-07/schema
|
|
type: object
|
|
required: ["metadata", "rules"]
|
|
anyOf:
|
|
# Do not alert on default Roles.
|
|
- properties:
|
|
metadata:
|
|
required: ["name"]
|
|
properties:
|
|
name:
|
|
type: string
|
|
anyOf:
|
|
- pattern: '^system:'
|
|
- const: "gce:podsecuritypolicy:calico-sa"
|
|
- properties:
|
|
metadata:
|
|
required: ["name"]
|
|
properties:
|
|
name:
|
|
type: string
|
|
rules:
|
|
type: array
|
|
items:
|
|
type: object
|
|
not:
|
|
required: ["apiGroups", "resources", "verbs"]
|
|
properties:
|
|
apiGroups:
|
|
type: array
|
|
contains:
|
|
type: string
|
|
anyOf:
|
|
- const: ""
|
|
- const: '*'
|
|
resources:
|
|
type: array
|
|
contains:
|
|
type: string
|
|
anyOf:
|
|
- const: '*'
|
|
- const: "pods/exec"
|
|
- const: "pods/attach"
|
|
verbs:
|
|
type: array
|
|
contains:
|
|
type: string
|
|
anyOf:
|
|
- const: '*'
|
|
# An exec is also possible by `get`ing a web socket.
|
|
- const: 'get'
|
|
- const: 'create'
|