Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[new rule] File ownerships #5

Merged
merged 6 commits into from
Nov 17, 2021
Merged

[new rule] File ownerships #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
7ef6ac7
Master Node Configuration - file ownership rules
oren-zohar Nov 11, 2021
0d8c8e7
Add test data generator
oren-zohar Nov 15, 2021
40f3602
Readme
oren-zohar Nov 15, 2021
453782a
Readme
oren-zohar Nov 15, 2021
efee44c
Merge branch 'test_data_generator' into file_ownerships
oren-zohar Nov 15, 2021
88b0320
Merge branch 'main' into file_ownerships
oren-zohar Nov 17, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions compliance/cis_k8s/rules/cis_1_1_14/rule.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
package compliance.cis.rules.cis_1_1_14

import data.compliance.cis_k8s
import data.compliance.lib.common
import data.compliance.lib.data_adapter

# Ensure that the admin.conf file ownership is set to root:root (Automated)
finding = result {
data_adapter.filename == "admin.conf"
uid = data_adapter.owner_user_id
gid = data_adapter.owner_group_id
rule_evaluation := common.file_ownership_match(uid, gid, "root", "root")

# set result
result := {
"evaluation": common.calculate_result(rule_evaluation),
"evidence": {"uid": uid, "gid": gid},
"rule_name": "Ensure that the API server pod specification file ownership is set to root:root",
"tags": array.concat(cis_k8s.default_tags, ["CIS 1.1.14"]),
}
}
23 changes: 23 additions & 0 deletions compliance/cis_k8s/rules/cis_1_1_14/test.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
package compliance.cis.rules.cis_1_1_14

import data.cis_k8s.test_data
import data.lib.test

test_violation {
test.assert_violation(finding) with input as rule_input("admin.conf", "root", "user")
test.assert_violation(finding) with input as rule_input("admin.conf", "user", "root")
test.assert_violation(finding) with input as rule_input("admin.conf", "user", "user")
}

test_pass {
test.assert_pass(finding) with input as rule_input("admin.conf", "root", "root")
}

test_not_evaluated {
not finding with input as rule_input("file.txt", "root", "root")
}

rule_input(filename, uid, gid) = filesystem_input {
filemode := "0644"
filesystem_input = test_data.filesystem_input(filename, filemode, uid, gid)
}
21 changes: 21 additions & 0 deletions compliance/cis_k8s/rules/cis_1_1_16/rule.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
package compliance.cis.rules.cis_1_1_16

import data.compliance.cis_k8s
import data.compliance.lib.common
import data.compliance.lib.data_adapter

# Ensure that the scheduler.conf file ownership is set to root:root (Automated)
finding = result {
data_adapter.filename == "scheduler.conf"
uid = data_adapter.owner_user_id
gid = data_adapter.owner_group_id
rule_evaluation := common.file_ownership_match(uid, gid, "root", "root")

# set result
result := {
"evaluation": common.calculate_result(rule_evaluation),
"evidence": {"uid": uid, "gid": gid},
"rule_name": "Ensure that the scheduler.conf file ownership is set to root:root",
"tags": array.concat(cis_k8s.default_tags, ["CIS 1.1.16"]),
}
}
23 changes: 23 additions & 0 deletions compliance/cis_k8s/rules/cis_1_1_16/test.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
package compliance.cis.rules.cis_1_1_16

import data.cis_k8s.test_data
import data.lib.test

test_violation {
test.assert_violation(finding) with input as rule_input("scheduler.conf", "root", "user")
test.assert_violation(finding) with input as rule_input("scheduler.conf", "user", "root")
test.assert_violation(finding) with input as rule_input("scheduler.conf", "user", "user")
}

test_pass {
test.assert_pass(finding) with input as rule_input("scheduler.conf", "root", "root")
}

test_not_evaluated {
not finding with input as rule_input("file.txt", "root", "root")
}

rule_input(filename, uid, gid) = filesystem_input {
filemode := "0644"
filesystem_input = test_data.filesystem_input(filename, filemode, uid, gid)
}
21 changes: 21 additions & 0 deletions compliance/cis_k8s/rules/cis_1_1_18/rule.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
package compliance.cis.rules.cis_1_1_18

import data.compliance.cis_k8s
import data.compliance.lib.common
import data.compliance.lib.data_adapter

# Ensure that the controller-manager.conf file ownership is set to root:root (Automated)
finding = result {
data_adapter.filename == "controller-manager.conf"
uid = data_adapter.owner_user_id
gid = data_adapter.owner_group_id
rule_evaluation := common.file_ownership_match(uid, gid, "root", "root")

# set result
result := {
"evaluation": common.calculate_result(rule_evaluation),
"evidence": {"uid": uid, "gid": gid},
"rule_name": " Ensure that the controller-manager.conf file ownership is set to root:root",
"tags": array.concat(cis_k8s.default_tags, ["CIS 1.1.18"]),
}
}
23 changes: 23 additions & 0 deletions compliance/cis_k8s/rules/cis_1_1_18/test.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
package compliance.cis.rules.cis_1_1_18

import data.cis_k8s.test_data
import data.lib.test

test_violation {
test.assert_violation(finding) with input as rule_input("controller-manager.conf", "root", "user")
test.assert_violation(finding) with input as rule_input("controller-manager.conf", "user", "root")
test.assert_violation(finding) with input as rule_input("controller-manager.conf", "user", "user")
}

test_pass {
test.assert_pass(finding) with input as rule_input("controller-manager.conf", "root", "root")
}

test_not_evaluated {
not finding with input as rule_input("file.txt", "root", "root")
}

rule_input(filename, uid, gid) = filesystem_input {
filemode := "0644"
filesystem_input = test_data.filesystem_input(filename, filemode, uid, gid)
}
21 changes: 21 additions & 0 deletions compliance/cis_k8s/rules/cis_1_1_4/rule.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
package compliance.cis.rules.cis_1_1_4

import data.compliance.cis_k8s
import data.compliance.lib.common
import data.compliance.lib.data_adapter

# Ensure that the controller manager pod specification file ownership is set to root:root (Automated)
finding = result {
data_adapter.filename == "kube-controller-manager.yaml"
uid = data_adapter.owner_user_id
gid = data_adapter.owner_group_id
rule_evaluation := common.file_ownership_match(uid, gid, "root", "root")

# set result
result := {
"evaluation": common.calculate_result(rule_evaluation),
"evidence": {"uid": uid, "gid": gid},
"rule_name": "Ensure that the controller manager pod specification file ownership is set to root:root",
"tags": array.concat(cis_k8s.default_tags, ["CIS 1.1.4"]),
}
}
23 changes: 23 additions & 0 deletions compliance/cis_k8s/rules/cis_1_1_4/test.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
package compliance.cis.rules.cis_1_1_4

import data.cis_k8s.test_data
import data.lib.test

test_violation {
test.assert_violation(finding) with input as rule_input("kube-controller-manager.yaml", "root", "user")
test.assert_violation(finding) with input as rule_input("kube-controller-manager.yaml", "user", "root")
test.assert_violation(finding) with input as rule_input("kube-controller-manager.yaml", "user", "user")
}

test_pass {
test.assert_pass(finding) with input as rule_input("kube-controller-manager.yaml", "root", "root")
}

test_not_evaluated {
not finding with input as rule_input("file.txt", "root", "root")
}

rule_input(filename, uid, gid) = filesystem_input {
filemode := "0644"
filesystem_input = test_data.filesystem_input(filename, filemode, uid, gid)
}
21 changes: 21 additions & 0 deletions compliance/cis_k8s/rules/cis_1_1_6/rule.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
package compliance.cis.rules.cis_1_1_6

import data.compliance.cis_k8s
import data.compliance.lib.common
import data.compliance.lib.data_adapter

# Ensure that the scheduler pod specification file ownership is set to root:root (Automated)
finding = result {
data_adapter.filename == "kube-scheduler.yaml"
uid = data_adapter.owner_user_id
gid = data_adapter.owner_group_id
rule_evaluation := common.file_ownership_match(uid, gid, "root", "root")

# set result
result := {
"evaluation": common.calculate_result(rule_evaluation),
"evidence": {"uid": uid, "gid": gid},
"rule_name": "Ensure that the scheduler pod specification file ownership is set to root:root",
"tags": array.concat(cis_k8s.default_tags, ["CIS 1.1.6"]),
}
}
23 changes: 23 additions & 0 deletions compliance/cis_k8s/rules/cis_1_1_6/test.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
package compliance.cis.rules.cis_1_1_6

import data.cis_k8s.test_data
import data.lib.test

test_violation {
test.assert_violation(finding) with input as rule_input("kube-scheduler.yaml", "root", "user")
test.assert_violation(finding) with input as rule_input("kube-scheduler.yaml", "user", "root")
test.assert_violation(finding) with input as rule_input("kube-scheduler.yaml", "user", "user")
}

test_pass {
test.assert_pass(finding) with input as rule_input("kube-scheduler.yaml", "root", "root")
}

test_not_evaluated {
not finding with input as rule_input("file.txt", "root", "root")
}

rule_input(filename, uid, gid) = filesystem_input {
filemode := "0644"
filesystem_input = test_data.filesystem_input(filename, filemode, uid, gid)
}
21 changes: 21 additions & 0 deletions compliance/cis_k8s/rules/cis_1_1_8/rule.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
package compliance.cis.rules.cis_1_1_8

import data.compliance.cis_k8s
import data.compliance.lib.common
import data.compliance.lib.data_adapter

# Ensure that the etcd pod specification file ownership is set to root:root (Automated)
finding = result {
data_adapter.filename == "etcd.yaml"
uid = data_adapter.owner_user_id
gid = data_adapter.owner_group_id
rule_evaluation := common.file_ownership_match(uid, gid, "root", "root")

# set result
result := {
"evaluation": common.calculate_result(rule_evaluation),
"evidence": {"uid": uid, "gid": gid},
"rule_name": "Ensure that the etcd pod specification file ownership is set to root:root",
"tags": array.concat(cis_k8s.default_tags, ["CIS 1.1.8"]),
}
}
23 changes: 23 additions & 0 deletions compliance/cis_k8s/rules/cis_1_1_8/test.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
package compliance.cis.rules.cis_1_1_8

import data.cis_k8s.test_data
import data.lib.test

test_violation {
test.assert_violation(finding) with input as rule_input("etcd.yaml", "root", "user")
test.assert_violation(finding) with input as rule_input("etcd.yaml", "user", "root")
test.assert_violation(finding) with input as rule_input("etcd.yaml", "user", "user")
}

test_pass {
test.assert_pass(finding) with input as rule_input("etcd.yaml", "root", "root")
}

test_not_evaluated {
not finding with input as rule_input("file.txt", "root", "root")
}

rule_input(filename, uid, gid) = filesystem_input {
filemode := "0644"
filesystem_input = test_data.filesystem_input(filename, filemode, uid, gid)
}
22 changes: 14 additions & 8 deletions compliance/lib/common.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,16 +2,22 @@ package compliance.lib.common

# set the rule result
calculate_result(evaluation) = "passed" {
evaluation
} else = "violation"
evaluation
} else = "violation" {
true
}
Comment on lines +6 to +8
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is due to open-policy-agent/opa#2445


file_ownership_match(uid, gid, requierd_uid, requierd_gid) {
uid == requierd_uid
gid == requierd_gid
} else = false
uid == requierd_uid
gid == requierd_gid
} else = false {
true
}

# todo: compare performance of regex alternatives
file_permission_match(filemode, user, group, other) {
pattern = sprintf("0?[0-%d][0-%d][0-%d]", [user, group, other])
regex.match(pattern, filemode)
} else = false
pattern = sprintf("0?[0-%d][0-%d][0-%d]", [user, group, other])
regex.match(pattern, filemode)
} else = false {
true
}
2 changes: 1 addition & 1 deletion main.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,5 +7,5 @@ import data.compliance.cis_k8s
# output is findings

resource = input
findings = cis_k8s.findings

findings = cis_k8s.findings