diff --git a/src/tools/genpolicy/genpolicy-settings.json b/src/tools/genpolicy/genpolicy-settings.json index ee50544c3c..8a612a5940 100644 --- a/src/tools/genpolicy/genpolicy-settings.json +++ b/src/tools/genpolicy/genpolicy-settings.json @@ -203,6 +203,7 @@ ], "common": { "cpath": "/run/kata-containers/shared/containers", + "mount_source_cpath": "/run/kata-containers/shared/containers", "sfprefix": "^$(cpath)/$(bundle-id)-[a-z0-9]{16}-", "ip_p": "[0-9]{1,5}", "ipv4_a": "(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])", diff --git a/src/tools/genpolicy/rules.rego b/src/tools/genpolicy/rules.rego index 76d734e0bb..fdc03e0a2f 100644 --- a/src/tools/genpolicy/rules.rego +++ b/src/tools/genpolicy/rules.rego @@ -805,7 +805,7 @@ check_mount(p_mount, i_mount, bundle_id, sandbox_id) { mount_source_allows(p_mount, i_mount, bundle_id, sandbox_id) { regex1 := p_mount.source regex2 := replace(regex1, "$(sfprefix)", policy_data.common.sfprefix) - regex3 := replace(regex2, "$(cpath)", policy_data.common.cpath) + regex3 := replace(regex2, "$(cpath)", policy_data.common.mount_source_cpath) regex4 := replace(regex3, "$(bundle-id)", bundle_id) print("mount_source_allows 1: regex4 =", regex4) @@ -816,7 +816,7 @@ mount_source_allows(p_mount, i_mount, bundle_id, sandbox_id) { mount_source_allows(p_mount, i_mount, bundle_id, sandbox_id) { regex1 := p_mount.source regex2 := replace(regex1, "$(sfprefix)", policy_data.common.sfprefix) - regex3 := replace(regex2, "$(cpath)", policy_data.common.cpath) + regex3 := replace(regex2, "$(cpath)", policy_data.common.mount_source_cpath) regex4 := replace(regex3, "$(sandbox-id)", sandbox_id) print("mount_source_allows 2: regex4 =", regex4) diff --git a/src/tools/genpolicy/src/policy.rs b/src/tools/genpolicy/src/policy.rs index c04e14e703..7cbfb86d21 100644 --- a/src/tools/genpolicy/src/policy.rs +++ b/src/tools/genpolicy/src/policy.rs @@ -349,6 +349,9 @@ pub struct CommonData { /// Path to the shared container files - e.g., "/run/kata-containers/shared/containers". pub cpath: String, + /// Path to the shared container files for mount sources - e.g., "/run/kata-containers/shared/containers". + pub mount_source_cpath: String, + /// Regex prefix for shared file paths - e.g., "^$(cpath)/$(bundle-id)-[a-z0-9]{16}-". pub sfprefix: String,