github/kata-containers
1
0
Fork 1
mirror of https://github.com/kata-containers/kata-containers.git synced 2025-07-17 00:43:36 +00:00
Code Issues Projects Releases Wiki Activity

genpolicy: validate probe process fields

Browse Source 
Validate more process fields for k8s probe commands - e.g.,
livenessProbe, readinessProbe, etc.

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
This commit is contained in:
Dan Mihai 2024-12-18 02:20:21 +00:00 committed by Ankita Pareek
parent c0b8c6ed5e
commit a113b9eefd
1 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/tools/genpolicy/rules.rego
View File

@ -686,6 +686,7 @@ allow_process_common(p_process, i_process, s_name) {
allow_process(p_process, i_process, s_name) { allow_process(p_process, i_process, s_name) {
print("allow_process: start") print("allow_process: start")
allow_args(p_process, i_process, s_name)
allow_process_common(p_process, i_process, s_name) allow_process_common(p_process, i_process, s_name)
allow_caps(p_process.Capabilities, i_process.Capabilities) allow_caps(p_process.Capabilities, i_process.Capabilities)
p_process.Terminal == i_process.Terminal p_process.Terminal == i_process.Terminal
@ -697,7 +698,6 @@ allow_process(p_process, i_process, s_name) {
allow_interactive_process(p_process, i_process, s_name) { allow_interactive_process(p_process, i_process, s_name) {
print("allow_interactive_process: start") print("allow_interactive_process: start")
allow_args(p_process, i_process, s_name)
allow_process_common(p_process, i_process, s_name) allow_process_common(p_process, i_process, s_name)
allow_exec_caps(i_process.Capabilities) allow_exec_caps(i_process.Capabilities)
@ -707,6 +707,17 @@ allow_interactive_process(p_process, i_process, s_name) {
print("allow_interactive_process: true") print("allow_interactive_process: true")
} }
# Compare the OCI Process field of a policy container with the input process field from ExecProcessRequest
allow_probe_process(p_process, i_process, s_name) {
print("allow_probe_process: start")
allow_process_common(p_process, i_process, s_name)
allow_exec_caps(i_process.Capabilities)
p_process.Terminal == i_process.Terminal
print("allow_probe_process: true")
}
allow_user(p_process, i_process) { allow_user(p_process, i_process) {
p_user := p_process.User p_user := p_process.User
i_user := i_process.User i_user := i_process.User