github/kata-containers
1
0
Fork 1
mirror of https://github.com/kata-containers/kata-containers.git synced 2025-08-31 16:36:38 +00:00
Code Issues Projects Releases Wiki Activity

genpolicy: Enable AdditionalGids checks in rules.rego

Browse Source 
With added support for parsing these fields in genpolicy, we can now
enable policy verification of AdditionalGids.

Signed-off-by: Cameron Baird <cameronbaird@microsoft.com>
This commit is contained in:
Cameron Baird
2025-04-24 22:25:55 +00:00
parent 29ee46c186
commit d3cd1af593
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/tools/genpolicy/rules.rego
View File

@@ -699,8 +699,8 @@ allow_user(p_process, i_process) {
print("allow_user: input gid =", i_user.GID, "policy gid =", p_user.GID)
p_user.GID == i_user.GID
# TODO: compare the additionalGids field too after computing its value
# based on /etc/passwd and /etc/group from the container image.
print("allow_user: input additionalGids =", i_user.AdditionalGids, "policy additionalGids =", p_user.AdditionalGids)
p_user.AdditionalGids == i_user.AdditionalGids
}
allow_args(p_process, i_process, s_name) {