From 8401adb113848b47625e6962d171618588411c5f Mon Sep 17 00:00:00 2001 From: Dan Mihai Date: Wed, 7 Feb 2024 21:50:17 +0000 Subject: [PATCH] genpolicy: update default values 1. Remove PullImageRequest because that is not used in the main branch. It was used in the CCv0 branch. 2. Add default false values for the remaining Kata Agent ttrpc requests. These changes don't change the functionality of the auto generated Policy, but they help with easier understanding the Policy text and the logging from the Rego rules. Fixes: #9049 Signed-off-by: Dan Mihai --- src/tools/genpolicy/rules.rego | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/src/tools/genpolicy/rules.rego b/src/tools/genpolicy/rules.rego index 75be33f594..f5f616ced6 100644 --- a/src/tools/genpolicy/rules.rego +++ b/src/tools/genpolicy/rules.rego @@ -10,6 +10,9 @@ import future.keywords.every import input # Default values, returned by OPA when rules cannot be evaluated to true. +default AddARPNeighborsRequest := false +default AddSwapRequest := false +default CloseStdinRequest := false default CopyFileRequest := false default CreateContainerRequest := false default CreateSandboxRequest := true @@ -17,15 +20,25 @@ default DestroySandboxRequest := true default ExecProcessRequest := false default GetOOMEventRequest := true default GuestDetailsRequest := true +default ListInterfacesRequest := false +default ListRoutesRequest := false +default MemHotplugByProbeRequest := false default OnlineCPUMemRequest := true -default PullImageRequest := true +default PauseContainerRequest := false default ReadStreamRequest := false default RemoveContainerRequest := true default RemoveStaleVirtiofsShareMountsRequest := true +default ReseedRandomDevRequest := false +default ResumeContainerRequest := false +default SetGuestDateTimeRequest := false +default SetPolicyRequest := false default SignalProcessRequest := true default StartContainerRequest := true +default StartTracingRequest := false default StatsContainerRequest := true +default StopTracingRequest := false default TtyWinResizeRequest := true +default UpdateContainerRequest := false default UpdateEphemeralMountsRequest := true default UpdateInterfaceRequest := true default UpdateRoutesRequest := true