Skip to content

Commit 4dd3a81

Browse files
jdesouzasudermanjr
jdesouza
and
sudermanjr
authored
INSIGHTS-475 Add 3 new checks to polaris (#1082)
* INSIGHTS-448 Add Two Polaris Checks * Added another chec * Added another chec * Added another chec * Added another chec * Added another chec * Added another chec * Fixing issue * Fixing issue * Added another validation * Added some tests cases * Added some tests cases * Update pkg/config/checks/hostProcess.yaml * Update pkg/validator/pod_test.go --------- Co-authored-by: Andy Suderman <[email protected]>
1 parent 4b87baf commit 4dd3a81

15 files changed

+227
-2
lines changed

‎pkg/config/checks.go

+3
Original file line numberDiff line numberDiff line change
@@ -29,11 +29,14 @@ var (
2929
"deploymentMissingReplicas",
3030
// Pod checks
3131
"hostIPCSet",
32+
"hostPathSet",
33+
"hostProcess",
3234
"hostPIDSet",
3335
"hostNetworkSet",
3436
"automountServiceAccountToken",
3537
"topologySpreadConstraint",
3638
// Container checks
39+
"procMount",
3740
"memoryLimitsMissing",
3841
"memoryRequestsMissing",
3942
"cpuLimitsMissing",

‎pkg/config/checks/hostPathSet.yaml

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
successMessage: HostPath volumes are not configured
2+
failureMessage: HostPath volumes must be forbidden
3+
category: Security
4+
target: PodSpec
5+
schema:
6+
'$schema': http://json-schema.org/draft-07/schema
7+
type: object
8+
properties:
9+
volumes:
10+
type: array
11+
items:
12+
type: object
13+
properties:
14+
hostPath:
15+
type: string
16+
const: ''

‎pkg/config/checks/hostProcess.yaml

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
successMessage: Privileged access to the host check is valid
2+
failureMessage: Privileged access to the host is disallowed
3+
category: Security
4+
target: PodSpec
5+
schema:
6+
'$schema': http://json-schema.org/draft-07/schema
7+
type: object
8+
properties:
9+
containers:
10+
type: array
11+
items:
12+
type: object
13+
properties:
14+
securityContext:
15+
type: object
16+
properties:
17+
windowsOptions:
18+
type: object
19+
properties:
20+
hostProcess:
21+
type: boolean
22+
const: false
23+
securityContext:
24+
type: object
25+
properties:
26+
windowsOptions:
27+
type: object
28+
properties:
29+
hostProcess:
30+
type: boolean
31+
const: false

‎pkg/config/checks/procMount.yaml

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
successMessage: The default /proc masks are set up to reduce attack surface, and should be required
2+
failureMessage: Proc mount must not be changed from the default
3+
category: Security
4+
target: PodSpec
5+
schema:
6+
'$schema': http://json-schema.org/draft-07/schema
7+
type: object
8+
properties:
9+
containers:
10+
type: array
11+
items:
12+
type: object
13+
properties:
14+
securityContext:
15+
type: object
16+
properties:
17+
procMount:
18+
type: string
19+
const: Default

‎pkg/config/default.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -23,11 +23,14 @@ checks:
2323
# security
2424
automountServiceAccountToken: warning
2525
hostIPCSet: danger
26+
hostPathSet: warning
27+
hostProcess: warning
2628
hostPIDSet: danger
2729
linuxHardening: warning
2830
missingNetworkPolicy: warning
2931
notReadOnlyRootFilesystem: warning
3032
privilegeEscalationAllowed: danger
33+
procMount: warning
3134
runAsRootAllowed: danger
3235
runAsPrivileged: danger
3336
dangerousCapabilities: danger

‎pkg/config/examples/config-full.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -23,11 +23,14 @@ checks:
2323
# security
2424
automountServiceAccountToken: warning
2525
hostIPCSet: danger
26+
hostPathSet: warning
27+
hostProcess: warning
2628
hostPIDSet: danger
2729
linuxHardening: danger
2830
missingNetworkPolicy: warning
2931
notReadOnlyRootFilesystem: warning
3032
privilegeEscalationAllowed: danger
33+
procMount: warning
3134
runAsRootAllowed: danger
3235
runAsPrivileged: danger
3336
dangerousCapabilities: danger

‎pkg/validator/pod_test.go

+32-2
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ import (
1818
"testing"
1919

2020
"github.com/stretchr/testify/assert"
21+
v1 "k8s.io/api/core/v1"
2122
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2223

2324
conf "github.com/fairwindsops/polaris/pkg/config"
@@ -32,14 +33,17 @@ func TestValidatePod(t *testing.T) {
3233
"hostPIDSet": conf.SeverityDanger,
3334
"hostNetworkSet": conf.SeverityWarning,
3435
"hostPortSet": conf.SeverityDanger,
36+
"hostPathSet": conf.SeverityWarning,
37+
"procMount": conf.SeverityWarning,
38+
"hostProcess": conf.SeverityWarning,
3539
},
3640
}
3741

3842
p := test.MockPod()
3943
deployment, err := kube.NewGenericResourceFromPod(p, nil)
4044
assert.NoError(t, err)
4145
expectedSum := CountSummary{
42-
Successes: uint(4),
46+
Successes: uint(7),
4347
Warnings: uint(0),
4448
Dangers: uint(0),
4549
}
@@ -48,6 +52,9 @@ func TestValidatePod(t *testing.T) {
4852
"hostIPCSet": {ID: "hostIPCSet", Message: "Host IPC is not configured", Success: true, Severity: "danger", Category: "Security"},
4953
"hostNetworkSet": {ID: "hostNetworkSet", Message: "Host network is not configured", Success: true, Severity: "warning", Category: "Security"},
5054
"hostPIDSet": {ID: "hostPIDSet", Message: "Host PID is not configured", Success: true, Severity: "danger", Category: "Security"},
55+
"hostPathSet": {ID: "hostPathSet", Message: "HostPath volumes are not configured", Success: true, Severity: "warning", Category: "Security"},
56+
"procMount": {ID: "procMount", Message: "The default /proc masks are set up to reduce attack surface, and should be required", Success: true, Severity: "warning", Category: "Security"},
57+
"hostProcess": {ID: "hostProcess", Message: "Privileged access to the host check is valid", Success: true, Severity: "warning", Category: "Security"},
5158
}
5259

5360
actualPodResult, err := applyControllerSchemaChecks(&c, nil, deployment)
@@ -67,22 +74,45 @@ func TestInvalidIPCPod(t *testing.T) {
6774
"hostPIDSet": conf.SeverityDanger,
6875
"hostNetworkSet": conf.SeverityWarning,
6976
"hostPortSet": conf.SeverityDanger,
77+
"hostPathSet": conf.SeverityWarning,
78+
"procMount": conf.SeverityWarning,
79+
"hostProcess": conf.SeverityWarning,
7080
},
7181
}
7282

7383
p := test.MockPod()
7484
p.Spec.HostIPC = true
85+
p.Spec.Volumes = append(p.Spec.Volumes, v1.Volume{
86+
Name: "hostpath",
87+
VolumeSource: v1.VolumeSource{
88+
HostPath: &v1.HostPathVolumeSource{
89+
Path: "/var/run/docker.sock",
90+
},
91+
},
92+
})
93+
procMount := v1.UnmaskedProcMount
94+
p.Spec.Containers[0].SecurityContext = &v1.SecurityContext{
95+
ProcMount: &procMount,
96+
}
97+
hostProcess := true
98+
p.Spec.Containers[0].SecurityContext.WindowsOptions = &v1.WindowsSecurityContextOptions{
99+
HostProcess: &hostProcess,
100+
}
101+
75102
workload, err := kube.NewGenericResourceFromPod(p, nil)
76103
assert.NoError(t, err)
77104
expectedSum := CountSummary{
78105
Successes: uint(3),
79-
Warnings: uint(0),
106+
Warnings: uint(3),
80107
Dangers: uint(1),
81108
}
82109
expectedResults := ResultSet{
83110
"hostIPCSet": {ID: "hostIPCSet", Message: "Host IPC should not be configured", Success: false, Severity: "danger", Category: "Security"},
84111
"hostNetworkSet": {ID: "hostNetworkSet", Message: "Host network is not configured", Success: true, Severity: "warning", Category: "Security"},
85112
"hostPIDSet": {ID: "hostPIDSet", Message: "Host PID is not configured", Success: true, Severity: "danger", Category: "Security"},
113+
"hostPathSet": {ID: "hostPathSet", Message: "HostPath volumes must be forbidden", Success: false, Severity: "warning", Category: "Security"},
114+
"procMount": {ID: "procMount", Message: "Proc mount must not be changed from the default", Success: false, Severity: "warning", Category: "Security"},
115+
"hostProcess": {ID: "hostProcess", Message: "Privileged access to the host is disallowed", Success: false, Severity: "warning", Category: "Security"},
86116
}
87117

88118
actualPodResult, err := applyControllerSchemaChecks(&c, nil, workload)

‎test/checks/hostPathSet/failure.yaml

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
apiVersion: v1
2+
kind: Pod
3+
metadata:
4+
name: nginx
5+
labels:
6+
app.kubernetes.io/name: nginx
7+
spec:
8+
containers:
9+
- name: nginx
10+
image: nginx
11+
volumes:
12+
- name: log-volume
13+
hostPath:
14+
path: /var/log

‎test/checks/hostPathSet/success.yaml

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: v1
2+
kind: Pod
3+
metadata:
4+
name: nginx
5+
labels:
6+
app.kubernetes.io/name: nginx
7+
spec:
8+
containers:
9+
- name: nginx
10+
image: nginx
11+
volumes:
12+
- name: log-volume

‎test/checks/hostProcess/failure.container.yaml

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
apiVersion: v1
2+
kind: Pod
3+
metadata:
4+
name: nginx
5+
labels:
6+
app.kubernetes.io/name: nginx
7+
spec:
8+
containers:
9+
- name: nginx
10+
image: nginx
11+
ports:
12+
- containerPort: 80
13+
hostPort: 8080
14+
securityContext:
15+
windowsOptions:
16+
hostProcess: true

‎test/checks/hostProcess/failure.yaml

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
apiVersion: v1
2+
kind: Pod
3+
metadata:
4+
name: nginx
5+
labels:
6+
app.kubernetes.io/name: nginx
7+
spec:
8+
containers:
9+
- name: nginx
10+
image: nginx
11+
ports:
12+
- containerPort: 80
13+
hostPort: 8080
14+
securityContext:
15+
windowsOptions:
16+
hostProcess: true

‎test/checks/hostProcess/success.container.yaml

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
apiVersion: v1
2+
kind: Pod
3+
metadata:
4+
name: nginx
5+
labels:
6+
app.kubernetes.io/name: nginx
7+
spec:
8+
containers:
9+
- name: nginx
10+
image: nginx
11+
ports:
12+
- containerPort: 80
13+
hostPort: 8080
14+
securityContext:
15+
windowsOptions:
16+
hostProcess: false

‎test/checks/hostProcess/success.yaml

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
apiVersion: v1
2+
kind: Pod
3+
metadata:
4+
name: nginx
5+
labels:
6+
app.kubernetes.io/name: nginx
7+
spec:
8+
containers:
9+
- name: nginx
10+
image: nginx
11+
ports:
12+
- containerPort: 80
13+
hostPort: 8080
14+
securityContext:
15+
windowsOptions:
16+
hostProcess: false

‎test/checks/procMount/failure.yaml

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
apiVersion: v1
2+
kind: Pod
3+
metadata:
4+
name: nginx
5+
labels:
6+
app.kubernetes.io/name: nginx
7+
spec:
8+
containers:
9+
- name: nginx
10+
image: nginx
11+
ports:
12+
- containerPort: 80
13+
hostPort: 8080
14+
securityContext:
15+
procMount: Other

‎test/checks/procMount/success.yaml

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
apiVersion: v1
2+
kind: Pod
3+
metadata:
4+
name: nginx
5+
labels:
6+
app.kubernetes.io/name: nginx
7+
spec:
8+
containers:
9+
- name: nginx
10+
image: nginx
11+
ports:
12+
- containerPort: 80
13+
hostPort: 8080
14+
securityContext:
15+
procMount: Default

0 commit comments

Comments
 (0)