Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(query): Fix searchKey and additional resource kinds in volume_mount_with_os_directory_write_permissions k8s rule #4889

Merged
merged 2 commits into from
Mar 4, 2022
Merged

fix(query): Fix searchKey and additional resource kinds in volume_mount_with_os_directory_write_permissions k8s rule #4889

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
fc88e48
fix(query): Fix searchKey and additional resource kinds in volume_mou…
Churro Feb 27, 2022
5c30253
Fixed keyExpectedValue to show readOnly: true instead of false
Churro Mar 2, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 21 additions & 14 deletions assets/queries/k8s/volume_mount_with_os_directory_write_permissions/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,40 +1,47 @@
package Cx

import data.generic.common as common_lib
import data.generic.k8s as k8sLib

types := {"initContainers", "containers"}

CxPolicy[result] {
resource := input.document[i]
containers := resource.spec[types[x]]
volumeMounts := containers[_].volumeMounts
document := input.document[i]
metadata := document.metadata

specInfo := k8sLib.getSpecInfo(document)
container := specInfo.spec[types[x]][_]

volumeMounts := container.volumeMounts
is_os_dir(volumeMounts[v].mountPath)
volumeMounts[v].readOnly == false

result := {
"documentId": input.document[i].id,
"searchKey": sprintf("metadata.name={{%s}}.spec.%s.volumeMounts.name={{%s}}.readyOnly", [resource.metadata.name, types[x], volumeMounts[v].name]),
"documentId": document.id,
"searchKey": sprintf("metadata.name={{%s}}.%s.%s.name={{%s}}.volumeMounts.name={{%s}}.readOnly", [metadata.name, specInfo.path, types[x], container.name, volumeMounts[v].name]),
"issueType": "IncorrectValue",
"keyExpectedValue": sprintf("spec.%s.volumeMounts[%s].readOnly is true", [types[x], volumeMounts[v].name]),
"keyActualValue": sprintf("spec.%s.volumeMounts[%s].readOnly is false", [types[x], volumeMounts[v].name]),
"keyExpectedValue": sprintf("metadata.name={{%s}}.%s.%s.name={{%s}}.volumeMounts.name={{%s}}.readOnly is true", [metadata.name, specInfo.path, types[x], container.name, volumeMounts[v].name]),
"keyActualValue": sprintf("metadata.name={{%s}}.%s.%s.name={{%s}}.volumeMounts.name={{%s}}.readOnly is false", [metadata.name, specInfo.path, types[x], container.name, volumeMounts[v].name]),
}
}

CxPolicy[result] {
resource := input.document[i]
containers := resource.spec[types[x]]
volumeMounts := containers[_].volumeMounts
document := input.document[i]
metadata := document.metadata

specInfo := k8sLib.getSpecInfo(document)
container := specInfo.spec[types[x]][_]

volumeMounts := container.volumeMounts
is_os_dir(volumeMounts[v].mountPath)
not common_lib.valid_key(volumeMounts[v], "readOnly")

result := {
"documentId": input.document[i].id,
"searchKey": sprintf("metadata.name={{%s}}.spec.%s.volumeMounts.name=%s", [resource.metadata.name, types[x], volumeMounts[v].name]),
"documentId": document.id,
"searchKey": sprintf("metadata.name={{%s}}.%s.%s.name={{%s}}.volumeMounts.name={{%s}}", [metadata.name, specInfo.path, types[x], container.name, volumeMounts[v].name]),
"issueType": "MissingAttribute",
"keyExpectedValue": sprintf("spec.%s.volumeMounts[%s].readOnly is set", [types[x], volumeMounts[v].name]),
"keyActualValue": sprintf("spec.%s.volumeMounts[%s].readOnly is undefined", [types[x], volumeMounts[v].name]),
"keyExpectedValue": sprintf("metadata.name={{%s}}.%s.%s.name={{%s}}.volumeMounts.name={{%s}}.readOnly is defined and set to true", [metadata.name, specInfo.path, types[x], container.name, volumeMounts[v].name]),
"keyActualValue": sprintf("metadata.name={{%s}}.%s.%s.name={{%s}}.volumeMounts.name={{%s}}.readOnly is undefined", [metadata.name, specInfo.path, types[x], container.name, volumeMounts[v].name]),
}
}

Expand Down
4 changes: 2 additions & 2 deletions ...s/k8s/volume_mount_with_os_directory_write_permissions/test/positive_expected_result.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,12 +2,12 @@
{
"queryName": "Volume Mount With OS Directory Write Permissions",
"severity": "MEDIUM",
"line": 13
"line": 14
},
{
"queryName": "Volume Mount With OS Directory Write Permissions",
"severity": "MEDIUM",
"line": 39
"line": 40
},
{
"queryName": "Volume Mount With OS Directory Write Permissions",
Expand Down