genpolicy: support readonly hostpath

Set hostpath access based on volume mount readOnly value

Signed-off-by: Saul Paredes <saulparedes@microsoft.com>

src/tools/genpolicy/src/mount_and_storage.rs

@@ -209,6 +209,13 @@ fn get_host_path_mount(
         }
     }
 
+    let access = match yaml_mount.readOnly {
+        Some(true) => {
+            debug!("setting read only access for host path mount");
+            "ro"
+        }
+        _ => "rw",
+    };
     // TODO:
     //
     // - When volume.hostPath.path: /dev/ttyS0
@@ -220,7 +227,7 @@ fn get_host_path_mount(
     if !path.starts_with("/dev/") && !path.starts_with("/sys/") {
         debug!("get_host_path_mount: calling get_shared_bind_mount");
         let propagation = if biderectional { "rshared" } else { "rprivate" };
-        get_shared_bind_mount(yaml_mount, p_mounts, propagation, "rw");
+        get_shared_bind_mount(yaml_mount, p_mounts, propagation, access);
     } else {
         let dest = yaml_mount.mountPath.clone();
         let type_ = "bind".to_string();
@@ -228,7 +235,7 @@ fn get_host_path_mount(
         let options = vec![
             "rbind".to_string(),
             mount_option.to_string(),
-            "rw".to_string(),
+            access.to_string(),
         ];
 
         if let Some(policy_mount) = p_mounts.iter_mut().find(|m| m.destination.eq(&dest)) {

tests/integration/kubernetes/runtimeclass_workloads/k8s-policy-rc.yaml

@@ -27,6 +27,17 @@ spec:
         volumeMounts:
           - name: host-empty-vol
             mountPath: "/host/cache"
+          - mountPath: /tmp/results
+            name: hostpath-vol
+          - mountPath: /tmp/results-read-only
+            name: hostpath-vol-read-only
+            readOnly: true
       volumes:
       - name: host-empty-vol
         emptyDir: {}
+      - name: hostpath-vol
+        hostPath:
+          path: /tmp/results
+      - name: hostpath-vol-read-only
+        hostPath:
+          path: /tmp/results-read-only