mirror of
https://github.com/FairwindsOps/polaris.git
synced 2026-05-11 11:47:12 +00:00
4d96993a18
* added fix command implementation * use node api * fix tests * added hostport mutate rule * update mutating server * fix array reference and add back leading slash * added test and refactor findNodes * more tests * added more test and fix issue with arrays * rename findNode function and ensure we capture exceptions * rename findNode function * append array value at the end and for single item remove brackets * append array value at the end and for single item remove brackets * create array if it does not exists * fix tests * handle some exceptions * fix tests * fix string format * guard for PodResult * fix flag name * fix privilegeEscalation check * fix up mutations for local files * fix pod parsing * fix object values * remove logspam * fix import * update some comments for health probes * add an option to not apply any mutations\, and just adjust yaml formatting * add preliminary support for helm * logspam * change up comment strategy * fix object comments * format * fix tests * add comments * fix key updates * fix mutation tests * tidy * refactor test * add test * add test * add test for object comments Co-authored-by: Robert Brennan <accounts@rbren.io> Co-authored-by: Robert Brennan <contact@rbren.io>
61 lines
1.8 KiB
YAML
61 lines
1.8 KiB
YAML
successMessage: Container does not have any insecure capabilities
|
|
failureMessage: Container should not have insecure capabilities
|
|
category: Security
|
|
target: Container
|
|
schema:
|
|
'$schema': http://json-schema.org/draft-07/schema
|
|
type: object
|
|
required:
|
|
- securityContext
|
|
properties:
|
|
securityContext:
|
|
type: object
|
|
required:
|
|
- capabilities
|
|
properties:
|
|
capabilities:
|
|
type: object
|
|
required:
|
|
- drop
|
|
properties:
|
|
drop:
|
|
type: array
|
|
oneOf:
|
|
- contains:
|
|
pattern: '^(?i)ALL$'
|
|
- allOf:
|
|
- contains:
|
|
pattern: '^(?i)NET_ADMIN$'
|
|
- contains:
|
|
pattern: '^(?i)CHOWN$'
|
|
- contains:
|
|
pattern: '^(?i)DAC_OVERRIDE$'
|
|
- contains:
|
|
pattern: '^(?i)FSETID$'
|
|
- contains:
|
|
pattern: '^(?i)FOWNER$'
|
|
- contains:
|
|
pattern: '^(?i)MKNOD$'
|
|
- contains:
|
|
pattern: '^(?i)NET_RAW$'
|
|
- contains:
|
|
pattern: '^(?i)SETGID$'
|
|
- contains:
|
|
pattern: '^(?i)SETUID$'
|
|
- contains:
|
|
pattern: '^(?i)SETFCAP$'
|
|
- contains:
|
|
pattern: '^(?i)SETPCAP$'
|
|
- contains:
|
|
pattern: '^(?i)NET_BIND_SERVICE$'
|
|
- contains:
|
|
pattern: '^(?i)SYS_CHROOT$'
|
|
- contains:
|
|
pattern: '^(?i)KILL$'
|
|
- contains:
|
|
pattern: '^(?i)AUDIT_WRITE$'
|
|
mutations:
|
|
- op: replace
|
|
path: /securityContext/capabilities
|
|
value: {"drop": ["ALL"]}
|