From 78eb65bb0b93f523a17dfbc0bc2457a71c13e892 Mon Sep 17 00:00:00 2001 From: Paul Meyer Date: Mon, 26 May 2025 16:28:09 +0200 Subject: [PATCH] genpolicy: fix svc_name regex The service name is specified as RFC 1035 lable name [1]. The svc_name regex in the genpolicy settings is applied to the downward API env variables created based on the service name. So it tries to match RFC 1035 labels after they are transformed to downward API variable names [2]. So the set of lower case alphanumerics and dashes is transformed to upper case alphanumerics and underscores. The previous regex wronly permitted use of numbers, but did allow dot and dash, which shouldn't be allowed (dot not because they aren't conform with RFC 1035, dash not because it is transformed to underscore). We have to take care not to also try to use the regex in places where we actually want to check for RFC 1035 label instead of the downward API transformed version of it. Further, we should consider using a format like JSON5/JSONC for the policy settings, as these are far from trivial and would highly benefit from proper documentation through comments. [1]: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service [2]: https://github.com/kubernetes/kubernetes/blob/b2dfba4151b859c31a27fe31f8703f9b2b758270/pkg/kubelet/envvars/envvars.go#L29-L70 Signed-off-by: Paul Meyer --- src/tools/genpolicy/genpolicy-settings.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/tools/genpolicy/genpolicy-settings.json b/src/tools/genpolicy/genpolicy-settings.json index e15ad13b82..f8f6abf0f8 100644 --- a/src/tools/genpolicy/genpolicy-settings.json +++ b/src/tools/genpolicy/genpolicy-settings.json @@ -255,7 +255,7 @@ "sfprefix": "^$(cpath)/$(bundle-id)-[a-z0-9]{16}-", "ip_p": "[0-9]{1,5}", "ipv4_a": "(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])", - "svc_name": "[A-Z_\\.\\-]+", + "svc_name": "[A-Z](?:[A-Z0-9_]{0,61}[A-Z0-9])?", "dns_label": "[a-zA-Z0-9_\\.\\-]+", "default_caps": [ "CAP_CHOWN",