Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Seccomp profile policy enforcement. #1705

Merged
merged 5 commits into from
Mar 28, 2023
Merged

Seccomp profile policy enforcement. #1705

merged 5 commits into from
Mar 28, 2023

Commits on Mar 21, 2023

  1. Seccomp profile policy enforcement. 

    This commit adds enforcement over the seccomp profile associated with a container. The
policy author can measure their seccomp profile and include this measurement in the
policy. Subsequently, they can provided that same seccomp profile to the orchestrator
(e.g. via an annotation) and GCS will measure the provided profile and provide this as
input to the policy engine.

This commit also adds a series of CRI tests for security context enforcement.

Signed-off-by: Matthew A Johnson <matjoh@microsoft.com>
    @matajoh
    matajoh committed Mar 21, 2023
    Configuration menu
    Copy the full SHA
    16faeb9 View commit details
    Browse the repository at this point in the history

Commits on Mar 23, 2023

  1. Changing the seccomp to blacklist instead of whitelist 

    Signed-off-by: Matthew Johnson <matjoh@microsoft.com>
    @matajoh
    matajoh committed Mar 23, 2023
    Configuration menu
    Copy the full SHA
    87984a4 View commit details
    Browse the repository at this point in the history

Commits on Mar 24, 2023

  1. Fixing error with privileged exec_in_container 

    Signed-off-by: Matthew A Johnson <matjoh@microsoft.com>
    @matajoh
    matajoh committed Mar 24, 2023
    Configuration menu
    Copy the full SHA
    f47aeea View commit details
    Browse the repository at this point in the history

  2. Adding CRI test for privileged exec in container 

    Signed-off-by: Matthew A Johnson <matjoh@microsoft.com>
    @matajoh
    matajoh committed Mar 24, 2023
    Configuration menu
    Copy the full SHA
    eac9a27 View commit details
    Browse the repository at this point in the history

Commits on Mar 28, 2023

  1. add TODOs for logging 

    Signed-off-by: Maksim An <maksiman@microsoft.com>
    @anmaxvl
    anmaxvl committed Mar 28, 2023
    Configuration menu
    Copy the full SHA
    06fd519 View commit details
    Browse the repository at this point in the history