github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-27 13:37:30 +00:00
Code Issues Projects Releases Wiki Activity

Cleanup & fix PodSecurityPolicy field path usage

Browse Source
This commit is contained in:
Tim Allclair 2018-07-17 17:41:50 -07:00
parent cdc411edf0
commit 5ace0f03d8
No known key found for this signature in database
GPG Key ID: 434D16BCEF479EAB
20 changed files with 86 additions and 94 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
pkg/security/podsecuritypolicy/capabilities/BUILD
View File

@ -29,6 +29,7 @@ go_test(
deps = [ deps = [
"//pkg/apis/core:go_default_library", "//pkg/apis/core:go_default_library",
"//pkg/apis/policy:go_default_library", "//pkg/apis/policy:go_default_library",
"//staging/src/k8s.io/apimachinery/pkg/util/validation/field:go_default_library",
], ],
) )

8
pkg/security/podsecuritypolicy/capabilities/capabilities.go
View File

@ -81,7 +81,7 @@ func (s *defaultCapabilities) Generate(pod *api.Pod, container *api.Container) (
} }
// Validate ensures that the specified values fall within the range of the strategy. // Validate ensures that the specified values fall within the range of the strategy.
func (s *defaultCapabilities) Validate(pod *api.Pod, container *api.Container, capabilities *api.Capabilities) field.ErrorList { func (s *defaultCapabilities) Validate(fldPath *field.Path, pod *api.Pod, container *api.Container, capabilities *api.Capabilities) field.ErrorList {
allErrs := field.ErrorList{} allErrs := field.ErrorList{}
if capabilities == nil { if capabilities == nil {
@ -94,7 +94,7 @@ func (s *defaultCapabilities) Validate(pod *api.Pod, container *api.Container, c
// container has no requested caps but we have required caps. We should have something in // container has no requested caps but we have required caps. We should have something in
// at least the drops on the container. // at least the drops on the container.
allErrs = append(allErrs, field.Invalid(field.NewPath("capabilities"), capabilities, allErrs = append(allErrs, field.Invalid(fldPath, capabilities,
"required capabilities are not set on the securityContext")) "required capabilities are not set on the securityContext"))
return allErrs return allErrs
} }
@ -112,7 +112,7 @@ func (s *defaultCapabilities) Validate(pod *api.Pod, container *api.Container, c
for _, cap := range capabilities.Add { for _, cap := range capabilities.Add {
sCap := string(cap) sCap := string(cap)
if !defaultAdd.Has(sCap) && !allowedAdd.Has(sCap) { if !defaultAdd.Has(sCap) && !allowedAdd.Has(sCap) {
allErrs = append(allErrs, field.Invalid(field.NewPath("capabilities", "add"), sCap, "capability may not be added")) allErrs = append(allErrs, field.Invalid(fldPath.Child("add"), sCap, "capability may not be added"))
} }
} }
@ -122,7 +122,7 @@ func (s *defaultCapabilities) Validate(pod *api.Pod, container *api.Container, c
for _, requiredDrop := range s.requiredDropCapabilities { for _, requiredDrop := range s.requiredDropCapabilities {
sDrop := string(requiredDrop) sDrop := string(requiredDrop)
if !containerDrops.Has(sDrop) { if !containerDrops.Has(sDrop) {
allErrs = append(allErrs, field.Invalid(field.NewPath("capabilities", "drop"), capabilities.Drop, allErrs = append(allErrs, field.Invalid(fldPath.Child("drop"), capabilities.Drop,
fmt.Sprintf("%s is required to be dropped but was not found", sDrop))) fmt.Sprintf("%s is required to be dropped but was not found", sDrop)))
} }
} }

5
pkg/security/podsecuritypolicy/capabilities/capabilities_test.go
View File

@ -20,6 +20,7 @@ import (
"reflect" "reflect"
"testing" "testing"
"k8s.io/apimachinery/pkg/util/validation/field"
api "k8s.io/kubernetes/pkg/apis/core" api "k8s.io/kubernetes/pkg/apis/core"
"k8s.io/kubernetes/pkg/apis/policy" "k8s.io/kubernetes/pkg/apis/policy"
) )
@ -329,7 +330,7 @@ func TestValidateAdds(t *testing.T) {
t.Errorf("%s failed: %v", k, err) t.Errorf("%s failed: %v", k, err)
continue continue
} }
errs := strategy.Validate(nil, nil, v.containerCaps) errs := strategy.Validate(field.NewPath("capabilities"), nil, nil, v.containerCaps)
if v.expectedError == "" && len(errs) > 0 { if v.expectedError == "" && len(errs) > 0 {
t.Errorf("%s should have passed but had errors %v", k, errs) t.Errorf("%s should have passed but had errors %v", k, errs)
continue continue
@ -390,7 +391,7 @@ func TestValidateDrops(t *testing.T) {
t.Errorf("%s failed: %v", k, err) t.Errorf("%s failed: %v", k, err)
continue continue
} }
errs := strategy.Validate(nil, nil, v.containerCaps) errs := strategy.Validate(field.NewPath("capabilities"), nil, nil, v.containerCaps)
if v.expectedError == "" && len(errs) > 0 { if v.expectedError == "" && len(errs) > 0 {
t.Errorf("%s should have passed but had errors %v", k, errs) t.Errorf("%s should have passed but had errors %v", k, errs)
continue continue

2
pkg/security/podsecuritypolicy/capabilities/types.go
View File

@ -26,5 +26,5 @@ type Strategy interface {
// Generate creates the capabilities based on policy rules. // Generate creates the capabilities based on policy rules.
Generate(pod *api.Pod, container *api.Container) (*api.Capabilities, error) Generate(pod *api.Pod, container *api.Container) (*api.Capabilities, error)
// Validate ensures that the specified values fall within the range of the strategy. // Validate ensures that the specified values fall within the range of the strategy.
Validate(pod *api.Pod, container *api.Container, capabilities *api.Capabilities) field.ErrorList Validate(fldPath *field.Path, pod *api.Pod, container *api.Container, capabilities *api.Capabilities) field.ErrorList
} }

4
pkg/security/podsecuritypolicy/factory.go
View File

@ -139,7 +139,7 @@ func createFSGroupStrategy(opts *policy.FSGroupStrategyOptions) (group.GroupStra
case policy.FSGroupStrategyRunAsAny: case policy.FSGroupStrategyRunAsAny:
return group.NewRunAsAny() return group.NewRunAsAny()
case policy.FSGroupStrategyMustRunAs: case policy.FSGroupStrategyMustRunAs:
return group.NewMustRunAs(opts.Ranges, fsGroupField) return group.NewMustRunAs(opts.Ranges)
default: default:
return nil, fmt.Errorf("Unrecognized FSGroup strategy type %s", opts.Rule) return nil, fmt.Errorf("Unrecognized FSGroup strategy type %s", opts.Rule)
} }
@ -151,7 +151,7 @@ func createSupplementalGroupStrategy(opts *policy.SupplementalGroupsStrategyOpti
case policy.SupplementalGroupsStrategyRunAsAny: case policy.SupplementalGroupsStrategyRunAsAny:
return group.NewRunAsAny() return group.NewRunAsAny()
case policy.SupplementalGroupsStrategyMustRunAs: case policy.SupplementalGroupsStrategyMustRunAs:
return group.NewMustRunAs(opts.Ranges, supplementalGroupsField) return group.NewMustRunAs(opts.Ranges)
default: default:
return nil, fmt.Errorf("Unrecognized SupplementalGroups strategy type %s", opts.Rule) return nil, fmt.Errorf("Unrecognized SupplementalGroups strategy type %s", opts.Rule)
} }

5
pkg/security/podsecuritypolicy/group/BUILD
View File

@ -30,7 +30,10 @@ go_test(
"runasany_test.go", "runasany_test.go",
], ],
embed = [":go_default_library"], embed = [":go_default_library"],
deps = ["//pkg/apis/policy:go_default_library"], deps = [
"//pkg/apis/policy:go_default_library",
"//staging/src/k8s.io/apimachinery/pkg/util/validation/field:go_default_library",
],
) )
filegroup( filegroup(

10
pkg/security/podsecuritypolicy/group/mustrunas.go
View File

@ -28,19 +28,17 @@ import (
// mustRunAs implements the GroupStrategy interface // mustRunAs implements the GroupStrategy interface
type mustRunAs struct { type mustRunAs struct {
ranges []policy.IDRange ranges []policy.IDRange
field string
} }
var _ GroupStrategy = &mustRunAs{} var _ GroupStrategy = &mustRunAs{}
// NewMustRunAs provides a new MustRunAs strategy based on ranges. // NewMustRunAs provides a new MustRunAs strategy based on ranges.
func NewMustRunAs(ranges []policy.IDRange, field string) (GroupStrategy, error) { func NewMustRunAs(ranges []policy.IDRange) (GroupStrategy, error) {
if len(ranges) == 0 { if len(ranges) == 0 {
return nil, fmt.Errorf("ranges must be supplied for MustRunAs") return nil, fmt.Errorf("ranges must be supplied for MustRunAs")
} }
return &mustRunAs{ return &mustRunAs{
ranges: ranges, ranges: ranges,
field: field,
}, nil }, nil
} }
@ -61,17 +59,17 @@ func (s *mustRunAs) GenerateSingle(_ *api.Pod) (*int64, error) {
// Validate ensures that the specified values fall within the range of the strategy. // Validate ensures that the specified values fall within the range of the strategy.
// Groups are passed in here to allow this strategy to support multiple group fields (fsgroup and // Groups are passed in here to allow this strategy to support multiple group fields (fsgroup and
// supplemental groups). // supplemental groups).
func (s *mustRunAs) Validate(_ *api.Pod, groups []int64) field.ErrorList { func (s *mustRunAs) Validate(fldPath *field.Path, _ *api.Pod, groups []int64) field.ErrorList {
allErrs := field.ErrorList{} allErrs := field.ErrorList{}
if len(groups) == 0 && len(s.ranges) > 0 { if len(groups) == 0 && len(s.ranges) > 0 {
allErrs = append(allErrs, field.Invalid(field.NewPath(s.field), groups, "unable to validate empty groups against required ranges")) allErrs = append(allErrs, field.Invalid(fldPath, groups, "unable to validate empty groups against required ranges"))
} }
for _, group := range groups { for _, group := range groups {
if !s.isGroupValid(group) { if !s.isGroupValid(group) {
detail := fmt.Sprintf("group %d must be in the ranges: %v", group, s.ranges) detail := fmt.Sprintf("group %d must be in the ranges: %v", group, s.ranges)
allErrs = append(allErrs, field.Invalid(field.NewPath(s.field), groups, detail)) allErrs = append(allErrs, field.Invalid(fldPath, groups, detail))
} }
} }

9
pkg/security/podsecuritypolicy/group/mustrunas_test.go
View File

@ -20,6 +20,7 @@ import (
"strings" "strings"
"testing" "testing"
"k8s.io/apimachinery/pkg/util/validation/field"
"k8s.io/kubernetes/pkg/apis/policy" "k8s.io/kubernetes/pkg/apis/policy"
) )
@ -40,7 +41,7 @@ func TestMustRunAsOptions(t *testing.T) {
} }
for k, v := range tests { for k, v := range tests {
_, err := NewMustRunAs(v.ranges, "") _, err := NewMustRunAs(v.ranges)
if v.pass && err != nil { if v.pass && err != nil {
t.Errorf("error creating strategy for %s: %v", k, err) t.Errorf("error creating strategy for %s: %v", k, err)
} }
@ -77,7 +78,7 @@ func TestGenerate(t *testing.T) {
} }
for k, v := range tests { for k, v := range tests {
s, err := NewMustRunAs(v.ranges, "") s, err := NewMustRunAs(v.ranges)
if err != nil { if err != nil {
t.Errorf("error creating strategy for %s: %v", k, err) t.Errorf("error creating strategy for %s: %v", k, err)
} }
@ -161,11 +162,11 @@ func TestValidate(t *testing.T) {
} }
for k, v := range tests { for k, v := range tests {
s, err := NewMustRunAs(v.ranges, "") s, err := NewMustRunAs(v.ranges)
if err != nil { if err != nil {
t.Errorf("error creating strategy for %s: %v", k, err) t.Errorf("error creating strategy for %s: %v", k, err)
} }
errs := s.Validate(nil, v.groups) errs := s.Validate(field.NewPath(""), nil, v.groups)
if v.expectedError == "" && len(errs) > 0 { if v.expectedError == "" && len(errs) > 0 {
t.Errorf("unexpected errors for %s: %v", k, errs) t.Errorf("unexpected errors for %s: %v", k, errs)
} }

2
pkg/security/podsecuritypolicy/group/runasany.go
View File

@ -43,7 +43,7 @@ func (s *runAsAny) GenerateSingle(_ *api.Pod) (*int64, error) {
} }
// Validate ensures that the specified values fall within the range of the strategy. // Validate ensures that the specified values fall within the range of the strategy.
func (s *runAsAny) Validate(_ *api.Pod, groups []int64) field.ErrorList { func (s *runAsAny) Validate(fldPath *field.Path, _ *api.Pod, groups []int64) field.ErrorList {
return field.ErrorList{} return field.ErrorList{}
} }

4
pkg/security/podsecuritypolicy/group/runasany_test.go
View File

@ -18,6 +18,8 @@ package group
import ( import (
"testing" "testing"
"k8s.io/apimachinery/pkg/util/validation/field"
) )
func TestRunAsAnyGenerate(t *testing.T) { func TestRunAsAnyGenerate(t *testing.T) {
@ -53,7 +55,7 @@ func TestRunAsAnyValidte(t *testing.T) {
if err != nil { if err != nil {
t.Fatalf("unexpected error initializing NewRunAsAny %v", err) t.Fatalf("unexpected error initializing NewRunAsAny %v", err)
} }
errs := s.Validate(nil, nil) errs := s.Validate(field.NewPath(""), nil, nil)
if len(errs) != 0 { if len(errs) != 0 {
t.Errorf("unexpected errors: %v", errs) t.Errorf("unexpected errors: %v", errs)
} }

2
pkg/security/podsecuritypolicy/group/types.go
View File

@ -31,5 +31,5 @@ type GroupStrategy interface {
// value to return if configured with multiple ranges. This is used for FSGroup. // value to return if configured with multiple ranges. This is used for FSGroup.
GenerateSingle(pod *api.Pod) (*int64, error) GenerateSingle(pod *api.Pod) (*int64, error)
// Validate ensures that the specified values fall within the range of the strategy. // Validate ensures that the specified values fall within the range of the strategy.
Validate(pod *api.Pod, groups []int64) field.ErrorList Validate(fldPath *field.Path, pod *api.Pod, groups []int64) field.ErrorList
} }

59
pkg/security/podsecuritypolicy/provider.go
View File

@ -27,13 +27,6 @@ import (
"k8s.io/kubernetes/pkg/securitycontext" "k8s.io/kubernetes/pkg/securitycontext"
) )
// used to pass in the field being validated for reusable group strategies so they
// can create informative error messages.
const (
fsGroupField = "fsGroup"
supplementalGroupsField = "supplementalGroups"
)
// simpleProvider is the default implementation of Provider. // simpleProvider is the default implementation of Provider.
type simpleProvider struct { type simpleProvider struct {
psp *policy.PodSecurityPolicy psp *policy.PodSecurityPolicy
@ -180,31 +173,32 @@ func (s *simpleProvider) DefaultContainerSecurityContext(pod *api.Pod, container
} }
// ValidatePod ensure a pod is in compliance with the given constraints. // ValidatePod ensure a pod is in compliance with the given constraints.
func (s *simpleProvider) ValidatePod(pod *api.Pod, fldPath *field.Path) field.ErrorList { func (s *simpleProvider) ValidatePod(pod *api.Pod) field.ErrorList {
allErrs := field.ErrorList{} allErrs := field.ErrorList{}
sc := securitycontext.NewPodSecurityContextAccessor(pod.Spec.SecurityContext) sc := securitycontext.NewPodSecurityContextAccessor(pod.Spec.SecurityContext)
scPath := field.NewPath("spec", "securityContext")
fsGroups := []int64{} var fsGroups []int64
if fsGroup := sc.FSGroup(); fsGroup != nil { if fsGroup := sc.FSGroup(); fsGroup != nil {
fsGroups = append(fsGroups, *fsGroup) fsGroups = []int64{*fsGroup}
} }
allErrs = append(allErrs, s.strategies.FSGroupStrategy.Validate(pod, fsGroups)...) allErrs = append(allErrs, s.strategies.FSGroupStrategy.Validate(scPath.Child("fsGroup"), pod, fsGroups)...)
allErrs = append(allErrs, s.strategies.SupplementalGroupStrategy.Validate(pod, sc.SupplementalGroups())...) allErrs = append(allErrs, s.strategies.SupplementalGroupStrategy.Validate(scPath.Child("supplementalGroups"), pod, sc.SupplementalGroups())...)
allErrs = append(allErrs, s.strategies.SeccompStrategy.ValidatePod(pod)...) allErrs = append(allErrs, s.strategies.SeccompStrategy.ValidatePod(pod)...)
allErrs = append(allErrs, s.strategies.SELinuxStrategy.Validate(fldPath.Child("seLinuxOptions"), pod, nil, sc.SELinuxOptions())...) allErrs = append(allErrs, s.strategies.SELinuxStrategy.Validate(scPath.Child("seLinuxOptions"), pod, nil, sc.SELinuxOptions())...)
if !s.psp.Spec.HostNetwork && sc.HostNetwork() { if !s.psp.Spec.HostNetwork && sc.HostNetwork() {
allErrs = append(allErrs, field.Invalid(fldPath.Child("hostNetwork"), sc.HostNetwork(), "Host network is not allowed to be used")) allErrs = append(allErrs, field.Invalid(scPath.Child("hostNetwork"), sc.HostNetwork(), "Host network is not allowed to be used"))
} }
if !s.psp.Spec.HostPID && sc.HostPID() { if !s.psp.Spec.HostPID && sc.HostPID() {
allErrs = append(allErrs, field.Invalid(fldPath.Child("hostPID"), sc.HostPID(), "Host PID is not allowed to be used")) allErrs = append(allErrs, field.Invalid(scPath.Child("hostPID"), sc.HostPID(), "Host PID is not allowed to be used"))
} }
if !s.psp.Spec.HostIPC && sc.HostIPC() { if !s.psp.Spec.HostIPC && sc.HostIPC() {
allErrs = append(allErrs, field.Invalid(fldPath.Child("hostIPC"), sc.HostIPC(), "Host IPC is not allowed to be used")) allErrs = append(allErrs, field.Invalid(scPath.Child("hostIPC"), sc.HostIPC(), "Host IPC is not allowed to be used"))
} }
allErrs = append(allErrs, s.strategies.SysctlsStrategy.Validate(pod)...) allErrs = append(allErrs, s.strategies.SysctlsStrategy.Validate(pod)...)
@ -268,7 +262,7 @@ func (s *simpleProvider) ValidatePod(pod *api.Pod, fldPath *field.Path) field.Er
} }
if !found { if !found {
allErrs = append(allErrs, allErrs = append(allErrs,
field.Invalid(fldPath.Child("volumes").Index(i).Child("driver"), driver, field.Invalid(field.NewPath("spec", "volumes").Index(i).Child("driver"), driver,
"Flexvolume driver is not allowed to be used")) "Flexvolume driver is not allowed to be used"))
} }
} }
@ -278,52 +272,43 @@ func (s *simpleProvider) ValidatePod(pod *api.Pod, fldPath *field.Path) field.Er
} }
// Ensure a container's SecurityContext is in compliance with the given constraints // Ensure a container's SecurityContext is in compliance with the given constraints
func (s *simpleProvider) ValidateContainerSecurityContext(pod *api.Pod, container *api.Container, fldPath *field.Path) field.ErrorList { func (s *simpleProvider) ValidateContainer(pod *api.Pod, container *api.Container, containerPath *field.Path) field.ErrorList {
allErrs := field.ErrorList{} allErrs := field.ErrorList{}
podSC := securitycontext.NewPodSecurityContextAccessor(pod.Spec.SecurityContext) podSC := securitycontext.NewPodSecurityContextAccessor(pod.Spec.SecurityContext)
sc := securitycontext.NewEffectiveContainerSecurityContextAccessor(podSC, securitycontext.NewContainerSecurityContextMutator(container.SecurityContext)) sc := securitycontext.NewEffectiveContainerSecurityContextAccessor(podSC, securitycontext.NewContainerSecurityContextMutator(container.SecurityContext))
allErrs = append(allErrs, s.strategies.RunAsUserStrategy.Validate(fldPath.Child("securityContext"), pod, container, sc.RunAsNonRoot(), sc.RunAsUser())...) scPath := containerPath.Child("securityContext")
allErrs = append(allErrs, s.strategies.SELinuxStrategy.Validate(fldPath.Child("seLinuxOptions"), pod, container, sc.SELinuxOptions())...) allErrs = append(allErrs, s.strategies.RunAsUserStrategy.Validate(scPath, pod, container, sc.RunAsNonRoot(), sc.RunAsUser())...)
allErrs = append(allErrs, s.strategies.SELinuxStrategy.Validate(scPath.Child("seLinuxOptions"), pod, container, sc.SELinuxOptions())...)
allErrs = append(allErrs, s.strategies.AppArmorStrategy.Validate(pod, container)...) allErrs = append(allErrs, s.strategies.AppArmorStrategy.Validate(pod, container)...)
allErrs = append(allErrs, s.strategies.SeccompStrategy.ValidateContainer(pod, container)...) allErrs = append(allErrs, s.strategies.SeccompStrategy.ValidateContainer(pod, container)...)
privileged := sc.Privileged() privileged := sc.Privileged()
if !s.psp.Spec.Privileged && privileged != nil && *privileged { if !s.psp.Spec.Privileged && privileged != nil && *privileged {
allErrs = append(allErrs, field.Invalid(fldPath.Child("privileged"), *privileged, "Privileged containers are not allowed")) allErrs = append(allErrs, field.Invalid(scPath.Child("privileged"), *privileged, "Privileged containers are not allowed"))
} }
allErrs = append(allErrs, s.strategies.CapabilitiesStrategy.Validate(pod, container, sc.Capabilities())...) allErrs = append(allErrs, s.strategies.CapabilitiesStrategy.Validate(scPath.Child("capabilities"), pod, container, sc.Capabilities())...)
containersPath := fldPath.Child("containers") allErrs = append(allErrs, s.hasInvalidHostPort(container, containerPath)...)
for idx, c := range pod.Spec.Containers {
idxPath := containersPath.Index(idx)
allErrs = append(allErrs, s.hasInvalidHostPort(&c, idxPath)...)
}
containersPath = fldPath.Child("initContainers")
for idx, c := range pod.Spec.InitContainers {
idxPath := containersPath.Index(idx)
allErrs = append(allErrs, s.hasInvalidHostPort(&c, idxPath)...)
}
if s.psp.Spec.ReadOnlyRootFilesystem { if s.psp.Spec.ReadOnlyRootFilesystem {
readOnly := sc.ReadOnlyRootFilesystem() readOnly := sc.ReadOnlyRootFilesystem()
if readOnly == nil { if readOnly == nil {
allErrs = append(allErrs, field.Invalid(fldPath.Child("readOnlyRootFilesystem"), readOnly, "ReadOnlyRootFilesystem may not be nil and must be set to true")) allErrs = append(allErrs, field.Invalid(scPath.Child("readOnlyRootFilesystem"), readOnly, "ReadOnlyRootFilesystem may not be nil and must be set to true"))
} else if !*readOnly { } else if !*readOnly {
allErrs = append(allErrs, field.Invalid(fldPath.Child("readOnlyRootFilesystem"), *readOnly, "ReadOnlyRootFilesystem must be set to true")) allErrs = append(allErrs, field.Invalid(scPath.Child("readOnlyRootFilesystem"), *readOnly, "ReadOnlyRootFilesystem must be set to true"))
} }
} }
allowEscalation := sc.AllowPrivilegeEscalation() allowEscalation := sc.AllowPrivilegeEscalation()
if !s.psp.Spec.AllowPrivilegeEscalation && allowEscalation == nil { if !s.psp.Spec.AllowPrivilegeEscalation && allowEscalation == nil {
allErrs = append(allErrs, field.Invalid(fldPath.Child("allowPrivilegeEscalation"), allowEscalation, "Allowing privilege escalation for containers is not allowed")) allErrs = append(allErrs, field.Invalid(scPath.Child("allowPrivilegeEscalation"), allowEscalation, "Allowing privilege escalation for containers is not allowed"))
} }
if !s.psp.Spec.AllowPrivilegeEscalation && allowEscalation != nil && *allowEscalation { if !s.psp.Spec.AllowPrivilegeEscalation && allowEscalation != nil && *allowEscalation {
allErrs = append(allErrs, field.Invalid(fldPath.Child("allowPrivilegeEscalation"), *allowEscalation, "Allowing privilege escalation for containers is not allowed")) allErrs = append(allErrs, field.Invalid(scPath.Child("allowPrivilegeEscalation"), *allowEscalation, "Allowing privilege escalation for containers is not allowed"))
} }
return allErrs return allErrs

32
pkg/security/podsecuritypolicy/provider_test.go
View File

@ -412,7 +412,7 @@ func TestValidatePodSecurityContextFailures(t *testing.T) {
if err != nil { if err != nil {
t.Fatalf("unable to create provider %v", err) t.Fatalf("unable to create provider %v", err)
} }
errs := provider.ValidatePod(v.pod, field.NewPath("")) errs := provider.ValidatePod(v.pod)
if len(errs) == 0 { if len(errs) == 0 {
t.Errorf("%s expected validation failure but did not receive errors", k) t.Errorf("%s expected validation failure but did not receive errors", k)
continue continue
@ -445,7 +445,7 @@ func allowFlexVolumesPSP(allowAllFlexVolumes, allowAllVolumes bool) *policy.PodS
return psp return psp
} }
func TestValidateContainerSecurityContextFailures(t *testing.T) { func TestValidateContainerFailures(t *testing.T) {
// fail user strategy // fail user strategy
failUserPSP := defaultPSP() failUserPSP := defaultPSP()
uid := int64(999) uid := int64(999)
@ -577,7 +577,7 @@ func TestValidateContainerSecurityContextFailures(t *testing.T) {
if err != nil { if err != nil {
t.Fatalf("unable to create provider %v", err) t.Fatalf("unable to create provider %v", err)
} }
errs := provider.ValidateContainerSecurityContext(v.pod, &v.pod.Spec.Containers[0], field.NewPath("")) errs := provider.ValidateContainer(v.pod, &v.pod.Spec.Containers[0], field.NewPath(""))
if len(errs) == 0 { if len(errs) == 0 {
t.Errorf("%s expected validation failure but did not receive errors", k) t.Errorf("%s expected validation failure but did not receive errors", k)
continue continue
@ -836,7 +836,7 @@ func TestValidatePodSecurityContextSuccess(t *testing.T) {
if err != nil { if err != nil {
t.Fatalf("unable to create provider %v", err) t.Fatalf("unable to create provider %v", err)
} }
errs := provider.ValidatePod(v.pod, field.NewPath("")) errs := provider.ValidatePod(v.pod)
if len(errs) != 0 { if len(errs) != 0 {
t.Errorf("%s expected validation pass but received errors %v", k, errs) t.Errorf("%s expected validation pass but received errors %v", k, errs)
continue continue
@ -844,7 +844,7 @@ func TestValidatePodSecurityContextSuccess(t *testing.T) {
} }
} }
func TestValidateContainerSecurityContextSuccess(t *testing.T) { func TestValidateContainerSuccess(t *testing.T) {
// success user strategy // success user strategy
userPSP := defaultPSP() userPSP := defaultPSP()
uid := int64(999) uid := int64(999)
@ -1001,7 +1001,7 @@ func TestValidateContainerSecurityContextSuccess(t *testing.T) {
if err != nil { if err != nil {
t.Fatalf("unable to create provider %v", err) t.Fatalf("unable to create provider %v", err)
} }
errs := provider.ValidateContainerSecurityContext(v.pod, &v.pod.Spec.Containers[0], field.NewPath("")) errs := provider.ValidateContainer(v.pod, &v.pod.Spec.Containers[0], field.NewPath(""))
if len(errs) != 0 { if len(errs) != 0 {
t.Errorf("%s expected validation pass but received errors %v\n%s", k, errs, spew.Sdump(v.pod.ObjectMeta)) t.Errorf("%s expected validation pass but received errors %v\n%s", k, errs, spew.Sdump(v.pod.ObjectMeta))
continue continue
@ -1198,7 +1198,7 @@ func TestValidateAllowedVolumes(t *testing.T) {
} }
// expect a denial for this PSP and test the error message to ensure it's related to the volumesource // expect a denial for this PSP and test the error message to ensure it's related to the volumesource
errs := provider.ValidatePod(pod, field.NewPath("")) errs := provider.ValidatePod(pod)
if len(errs) != 1 { if len(errs) != 1 {
t.Errorf("expected exactly 1 error for %s but got %v", fieldVal.Name, errs) t.Errorf("expected exactly 1 error for %s but got %v", fieldVal.Name, errs)
} else { } else {
@ -1209,14 +1209,14 @@ func TestValidateAllowedVolumes(t *testing.T) {
// now add the fstype directly to the psp and it should validate // now add the fstype directly to the psp and it should validate
psp.Spec.Volumes = []policy.FSType{fsType} psp.Spec.Volumes = []policy.FSType{fsType}
errs = provider.ValidatePod(pod, field.NewPath("")) errs = provider.ValidatePod(pod)
if len(errs) != 0 { if len(errs) != 0 {
t.Errorf("directly allowing volume expected no errors for %s but got %v", fieldVal.Name, errs) t.Errorf("directly allowing volume expected no errors for %s but got %v", fieldVal.Name, errs)
} }
// now change the psp to allow any volumes and the pod should still validate // now change the psp to allow any volumes and the pod should still validate
psp.Spec.Volumes = []policy.FSType{policy.All} psp.Spec.Volumes = []policy.FSType{policy.All}
errs = provider.ValidatePod(pod, field.NewPath("")) errs = provider.ValidatePod(pod)
if len(errs) != 0 { if len(errs) != 0 {
t.Errorf("wildcard volume expected no errors for %s but got %v", fieldVal.Name, errs) t.Errorf("wildcard volume expected no errors for %s but got %v", fieldVal.Name, errs)
} }
@ -1241,7 +1241,7 @@ func TestValidateAllowPrivilegeEscalation(t *testing.T) {
} }
// expect a denial for this PSP and test the error message to ensure it's related to allowPrivilegeEscalation // expect a denial for this PSP and test the error message to ensure it's related to allowPrivilegeEscalation
errs := provider.ValidateContainerSecurityContext(pod, &pod.Spec.Containers[0], field.NewPath("")) errs := provider.ValidateContainer(pod, &pod.Spec.Containers[0], field.NewPath(""))
if len(errs) != 1 { if len(errs) != 1 {
t.Errorf("expected exactly 1 error but got %v", errs) t.Errorf("expected exactly 1 error but got %v", errs)
} else { } else {
@ -1252,7 +1252,7 @@ func TestValidateAllowPrivilegeEscalation(t *testing.T) {
// now add allowPrivilegeEscalation to the podSecurityPolicy // now add allowPrivilegeEscalation to the podSecurityPolicy
psp.Spec.AllowPrivilegeEscalation = true psp.Spec.AllowPrivilegeEscalation = true
errs = provider.ValidateContainerSecurityContext(pod, &pod.Spec.Containers[0], field.NewPath("")) errs = provider.ValidateContainer(pod, &pod.Spec.Containers[0], field.NewPath(""))
if len(errs) != 0 { if len(errs) != 0 {
t.Errorf("directly allowing privilege escalation expected no errors but got %v", errs) t.Errorf("directly allowing privilege escalation expected no errors but got %v", errs)
} }
@ -1278,7 +1278,7 @@ func TestValidateDefaultAllowPrivilegeEscalation(t *testing.T) {
} }
// expect a denial for this PSP and test the error message to ensure it's related to allowPrivilegeEscalation // expect a denial for this PSP and test the error message to ensure it's related to allowPrivilegeEscalation
errs := provider.ValidateContainerSecurityContext(pod, &pod.Spec.Containers[0], field.NewPath("")) errs := provider.ValidateContainer(pod, &pod.Spec.Containers[0], field.NewPath(""))
if len(errs) != 1 { if len(errs) != 1 {
t.Errorf("expected exactly 1 error but got %v", errs) t.Errorf("expected exactly 1 error but got %v", errs)
} else { } else {
@ -1294,7 +1294,7 @@ func TestValidateDefaultAllowPrivilegeEscalation(t *testing.T) {
// expect a denial for this PSP because we did not allowPrivilege Escalation via the PodSecurityPolicy // expect a denial for this PSP because we did not allowPrivilege Escalation via the PodSecurityPolicy
// and test the error message to ensure it's related to allowPrivilegeEscalation // and test the error message to ensure it's related to allowPrivilegeEscalation
errs = provider.ValidateContainerSecurityContext(pod, &pod.Spec.Containers[0], field.NewPath("")) errs = provider.ValidateContainer(pod, &pod.Spec.Containers[0], field.NewPath(""))
if len(errs) != 1 { if len(errs) != 1 {
t.Errorf("expected exactly 1 error but got %v", errs) t.Errorf("expected exactly 1 error but got %v", errs)
} else { } else {
@ -1305,7 +1305,7 @@ func TestValidateDefaultAllowPrivilegeEscalation(t *testing.T) {
// Now set AllowPrivilegeEscalation // Now set AllowPrivilegeEscalation
psp.Spec.AllowPrivilegeEscalation = true psp.Spec.AllowPrivilegeEscalation = true
errs = provider.ValidateContainerSecurityContext(pod, &pod.Spec.Containers[0], field.NewPath("")) errs = provider.ValidateContainer(pod, &pod.Spec.Containers[0], field.NewPath(""))
if len(errs) != 0 { if len(errs) != 0 {
t.Errorf("directly allowing privilege escalation expected no errors but got %v", errs) t.Errorf("directly allowing privilege escalation expected no errors but got %v", errs)
} }
@ -1313,7 +1313,7 @@ func TestValidateDefaultAllowPrivilegeEscalation(t *testing.T) {
// Now set the psp spec to false and reset AllowPrivilegeEscalation // Now set the psp spec to false and reset AllowPrivilegeEscalation
psp.Spec.AllowPrivilegeEscalation = false psp.Spec.AllowPrivilegeEscalation = false
pod.Spec.Containers[0].SecurityContext.AllowPrivilegeEscalation = nil pod.Spec.Containers[0].SecurityContext.AllowPrivilegeEscalation = nil
errs = provider.ValidateContainerSecurityContext(pod, &pod.Spec.Containers[0], field.NewPath("")) errs = provider.ValidateContainer(pod, &pod.Spec.Containers[0], field.NewPath(""))
if len(errs) != 1 { if len(errs) != 1 {
t.Errorf("expected exactly 1 error but got %v", errs) t.Errorf("expected exactly 1 error but got %v", errs)
} else { } else {
@ -1325,7 +1325,7 @@ func TestValidateDefaultAllowPrivilegeEscalation(t *testing.T) {
// Now unset both AllowPrivilegeEscalation // Now unset both AllowPrivilegeEscalation
psp.Spec.AllowPrivilegeEscalation = true psp.Spec.AllowPrivilegeEscalation = true
pod.Spec.Containers[0].SecurityContext.AllowPrivilegeEscalation = nil pod.Spec.Containers[0].SecurityContext.AllowPrivilegeEscalation = nil
errs = provider.ValidateContainerSecurityContext(pod, &pod.Spec.Containers[0], field.NewPath("")) errs = provider.ValidateContainer(pod, &pod.Spec.Containers[0], field.NewPath(""))
if len(errs) != 0 { if len(errs) != 0 {
t.Errorf("resetting allowing privilege escalation expected no errors but got %v", errs) t.Errorf("resetting allowing privilege escalation expected no errors but got %v", errs)
} }

6
pkg/security/podsecuritypolicy/types.go
View File

@ -39,9 +39,9 @@ type Provider interface {
// It modifies the SecurityContext of the container and annotations of the pod. // It modifies the SecurityContext of the container and annotations of the pod.
DefaultContainerSecurityContext(pod *api.Pod, container *api.Container) error DefaultContainerSecurityContext(pod *api.Pod, container *api.Container) error
// Ensure a pod is in compliance with the given constraints. // Ensure a pod is in compliance with the given constraints.
ValidatePod(pod *api.Pod, fldPath *field.Path) field.ErrorList ValidatePod(pod *api.Pod) field.ErrorList
// Ensure a container's SecurityContext is in compliance with the given constraints // Ensure a container's SecurityContext is in compliance with the given constraints.
ValidateContainerSecurityContext(pod *api.Pod, container *api.Container, fldPath *field.Path) field.ErrorList ValidateContainer(pod *api.Pod, container *api.Container, containerPath *field.Path) field.ErrorList
// Get the name of the PSP that this provider was initialized with. // Get the name of the PSP that this provider was initialized with.
GetPSPName() string GetPSPName() string
} }

6
pkg/security/podsecuritypolicy/user/mustrunas.go
View File

@ -49,17 +49,17 @@ func (s *mustRunAs) Generate(pod *api.Pod, container *api.Container) (*int64, er
} }
// Validate ensures that the specified values fall within the range of the strategy. // Validate ensures that the specified values fall within the range of the strategy.
func (s *mustRunAs) Validate(fldPath *field.Path, _ *api.Pod, _ *api.Container, runAsNonRoot *bool, runAsUser *int64) field.ErrorList { func (s *mustRunAs) Validate(scPath *field.Path, _ *api.Pod, _ *api.Container, runAsNonRoot *bool, runAsUser *int64) field.ErrorList {
allErrs := field.ErrorList{} allErrs := field.ErrorList{}
if runAsUser == nil { if runAsUser == nil {
allErrs = append(allErrs, field.Required(fldPath.Child("runAsUser"), "")) allErrs = append(allErrs, field.Required(scPath.Child("runAsUser"), ""))
return allErrs return allErrs
} }
if !s.isValidUID(*runAsUser) { if !s.isValidUID(*runAsUser) {
detail := fmt.Sprintf("must be in the ranges: %v", s.opts.Ranges) detail := fmt.Sprintf("must be in the ranges: %v", s.opts.Ranges)
allErrs = append(allErrs, field.Invalid(fldPath.Child("runAsUser"), *runAsUser, detail)) allErrs = append(allErrs, field.Invalid(scPath.Child("runAsUser"), *runAsUser, detail))
} }
return allErrs return allErrs
} }

8
pkg/security/podsecuritypolicy/user/nonroot.go
View File

@ -41,18 +41,18 @@ func (s *nonRoot) Generate(pod *api.Pod, container *api.Container) (*int64, erro
// or if the UID is set it is not root. Validation will fail if RunAsNonRoot is set to false. // or if the UID is set it is not root. Validation will fail if RunAsNonRoot is set to false.
// In order to work properly this assumes that the kubelet performs a final check on runAsUser // In order to work properly this assumes that the kubelet performs a final check on runAsUser
// or the image UID when runAsUser is nil. // or the image UID when runAsUser is nil.
func (s *nonRoot) Validate(fldPath *field.Path, _ *api.Pod, _ *api.Container, runAsNonRoot *bool, runAsUser *int64) field.ErrorList { func (s *nonRoot) Validate(scPath *field.Path, _ *api.Pod, _ *api.Container, runAsNonRoot *bool, runAsUser *int64) field.ErrorList {
allErrs := field.ErrorList{} allErrs := field.ErrorList{}
if runAsNonRoot == nil && runAsUser == nil { if runAsNonRoot == nil && runAsUser == nil {
allErrs = append(allErrs, field.Required(fldPath.Child("runAsNonRoot"), "must be true")) allErrs = append(allErrs, field.Required(scPath.Child("runAsNonRoot"), "must be true"))
return allErrs return allErrs
} }
if runAsNonRoot != nil && *runAsNonRoot == false { if runAsNonRoot != nil && *runAsNonRoot == false {
allErrs = append(allErrs, field.Invalid(fldPath.Child("runAsNonRoot"), *runAsNonRoot, "must be true")) allErrs = append(allErrs, field.Invalid(scPath.Child("runAsNonRoot"), *runAsNonRoot, "must be true"))
return allErrs return allErrs
} }
if runAsUser != nil && *runAsUser == 0 { if runAsUser != nil && *runAsUser == 0 {
allErrs = append(allErrs, field.Invalid(fldPath.Child("runAsUser"), *runAsUser, "running with the root UID is forbidden")) allErrs = append(allErrs, field.Invalid(scPath.Child("runAsUser"), *runAsUser, "running with the root UID is forbidden"))
return allErrs return allErrs
} }
return allErrs return allErrs

2
pkg/security/podsecuritypolicy/user/runasany.go
View File

@ -38,6 +38,6 @@ func (s *runAsAny) Generate(pod *api.Pod, container *api.Container) (*int64, err
} }
// Validate ensures that the specified values fall within the range of the strategy. // Validate ensures that the specified values fall within the range of the strategy.
func (s *runAsAny) Validate(fldPath *field.Path, _ *api.Pod, _ *api.Container, runAsNonRoot *bool, runAsUser *int64) field.ErrorList { func (s *runAsAny) Validate(_ *field.Path, _ *api.Pod, _ *api.Container, runAsNonRoot *bool, runAsUser *int64) field.ErrorList {
return field.ErrorList{} return field.ErrorList{}
} }

3
pkg/security/podsecuritypolicy/user/types.go
View File

@ -26,5 +26,6 @@ type RunAsUserStrategy interface {
// Generate creates the uid based on policy rules. // Generate creates the uid based on policy rules.
Generate(pod *api.Pod, container *api.Container) (*int64, error) Generate(pod *api.Pod, container *api.Container) (*int64, error)
// Validate ensures that the specified values fall within the range of the strategy. // Validate ensures that the specified values fall within the range of the strategy.
Validate(fldPath *field.Path, pod *api.Pod, container *api.Container, runAsNonRoot *bool, runAsUser *int64) field.ErrorList // scPath is the field path to the container's security context
Validate(scPath *field.Path, pod *api.Pod, container *api.Container, runAsNonRoot *bool, runAsUser *int64) field.ErrorList
} }

10
plugin/pkg/admission/security/podsecuritypolicy/admission.go
View File

@ -258,7 +258,7 @@ func (c *PodSecurityPolicyPlugin) computeSecurityContext(a admission.Attributes,
for _, provider := range providers { for _, provider := range providers {
podCopy := pod.DeepCopy() podCopy := pod.DeepCopy()
if errs := assignSecurityContext(provider, podCopy, field.NewPath(fmt.Sprintf("provider %s: ", provider.GetPSPName()))); len(errs) > 0 { if errs := assignSecurityContext(provider, podCopy); len(errs) > 0 {
validationErrs[provider.GetPSPName()] = errs validationErrs[provider.GetPSPName()] = errs
continue continue
} }
@ -303,7 +303,7 @@ func (c *PodSecurityPolicyPlugin) computeSecurityContext(a admission.Attributes,
// assignSecurityContext creates a security context for each container in the pod // assignSecurityContext creates a security context for each container in the pod
// and validates that the sc falls within the psp constraints. All containers must validate against // and validates that the sc falls within the psp constraints. All containers must validate against
// the same psp or is not considered valid. // the same psp or is not considered valid.
func assignSecurityContext(provider psp.Provider, pod *api.Pod, fldPath *field.Path) field.ErrorList { func assignSecurityContext(provider psp.Provider, pod *api.Pod) field.ErrorList {
errs := field.ErrorList{} errs := field.ErrorList{}
err := provider.DefaultPodSecurityContext(pod) err := provider.DefaultPodSecurityContext(pod)
@ -311,7 +311,7 @@ func assignSecurityContext(provider psp.Provider, pod *api.Pod, fldPath *field.P
errs = append(errs, field.Invalid(field.NewPath("spec", "securityContext"), pod.Spec.SecurityContext, err.Error())) errs = append(errs, field.Invalid(field.NewPath("spec", "securityContext"), pod.Spec.SecurityContext, err.Error()))
} }
errs = append(errs, provider.ValidatePod(pod, field.NewPath("spec", "securityContext"))...) errs = append(errs, provider.ValidatePod(pod)...)
for i := range pod.Spec.InitContainers { for i := range pod.Spec.InitContainers {
err := provider.DefaultContainerSecurityContext(pod, &pod.Spec.InitContainers[i]) err := provider.DefaultContainerSecurityContext(pod, &pod.Spec.InitContainers[i])
@ -319,7 +319,7 @@ func assignSecurityContext(provider psp.Provider, pod *api.Pod, fldPath *field.P
errs = append(errs, field.Invalid(field.NewPath("spec", "initContainers").Index(i).Child("securityContext"), "", err.Error())) errs = append(errs, field.Invalid(field.NewPath("spec", "initContainers").Index(i).Child("securityContext"), "", err.Error()))
continue continue
} }
errs = append(errs, provider.ValidateContainerSecurityContext(pod, &pod.Spec.InitContainers[i], field.NewPath("spec", "initContainers").Index(i).Child("securityContext"))...) errs = append(errs, provider.ValidateContainer(pod, &pod.Spec.InitContainers[i], field.NewPath("spec", "initContainers").Index(i))...)
} }
for i := range pod.Spec.Containers { for i := range pod.Spec.Containers {
@ -328,7 +328,7 @@ func assignSecurityContext(provider psp.Provider, pod *api.Pod, fldPath *field.P
errs = append(errs, field.Invalid(field.NewPath("spec", "containers").Index(i).Child("securityContext"), "", err.Error())) errs = append(errs, field.Invalid(field.NewPath("spec", "containers").Index(i).Child("securityContext"), "", err.Error()))
continue continue
} }
errs = append(errs, provider.ValidateContainerSecurityContext(pod, &pod.Spec.Containers[i], field.NewPath("spec", "containers").Index(i).Child("securityContext"))...) errs = append(errs, provider.ValidateContainer(pod, &pod.Spec.Containers[i], field.NewPath("spec", "containers").Index(i))...)
} }
if len(errs) > 0 { if len(errs) > 0 {

2
plugin/pkg/admission/security/podsecuritypolicy/admission_test.go
View File

@ -1876,7 +1876,7 @@ func TestAssignSecurityContext(t *testing.T) {
} }
for k, v := range testCases { for k, v := range testCases {
errs := assignSecurityContext(provider, v.pod, nil) errs := assignSecurityContext(provider, v.pod)
if v.shouldValidate && len(errs) > 0 { if v.shouldValidate && len(errs) > 0 {
t.Errorf("%s expected to validate but received errors %v", k, errs) t.Errorf("%s expected to validate but received errors %v", k, errs)
continue continue