Single policy to block everything expect few source

[janavenkat]

We're trying to understand the policy for the containers.

We have already read about security policy
https://docs.kubearmor.io/kubearmor/documentation/security_policy_specification

What we want to achieve is to block file access to /run/secrets directory expect from the php process, currently we have to define two policies. If we do this blacklist mode is enabled because of the allow action, this means we have to specify the all of the other path in the container.

1. Allow PHP process to access the dir

apiVersion: security.kubearmor.com/v1
kind: KubeArmorPolicy
metadata:
  name: aws-creds-allow-php
  namespace: test
spec:
  selector:
    matchLabels:
      repository: test
  file:
    matchDirectories:
      - dir: /run/secrets/
        fromSource:
          - path: /usr/local/bin/php
  action:
    Allow.  ==> This fallback to defaultPosture

2. Block all process to access the dir

apiVersion: security.kubearmor.com/v1
kind: KubeArmorPolicy
metadata:
  name: aws-creds-block
  namespace: test
spec:
  selector:
    matchLabels:
      repository: test
  file:
    matchDirectories:
      - dir: /run/secrets/
  action:
    Block

Is there a way to achieve this without the blacklist mode behaviour?

[janavenkat]

@nyrahul @daemon1024

[daemon1024]

Hey @janavenkat, this is a very valid usecase. And we already have a particular example which describes this exact usecase

KubeArmor/tests/k8s_env/smoke/res/ksp-wordpress-lenient-allow-sa.yaml

Lines 11 to 21 in 0b27784

	file:
	matchDirectories:
	- dir: /run/secrets/kubernetes.io/serviceaccount/
	recursive: true
	action: Block
	- dir: /
	recursive: true
	- dir: /run/secrets/kubernetes.io/serviceaccount/
	recursive: true
	fromSource:
	- path: /bin/cat

If you see here, we are blocking access to the service account folder and only allowing it to /bin/cat.

It involves both blacklist and whitelist behaviour so you cannot change the DefaultPosture just to audit the access.
You will need to change Block here to Audit if you want to Audit the behaviour instead of enforcing it.

[janavenkat]

@daemon1024 thank you for the reply, much appreciated.

I am trying to find another example. For instance, a process cannot call a subprocess. It can execute itself, but it cannot call id.

[janavenkat]

Hey @janavenkat, this is a very valid usecase. And we already have a particular example which describes this exact usecase

KubeArmor/tests/k8s_env/smoke/res/ksp-wordpress-lenient-allow-sa.yaml

Lines 11 to 21 in 0b27784

	file:
	matchDirectories:
	- dir: /run/secrets/kubernetes.io/serviceaccount/
	recursive: true
	action: Block
	- dir: /
	recursive: true
	- dir: /run/secrets/kubernetes.io/serviceaccount/
	recursive: true
	fromSource:
	- path: /bin/cat

If you see here, we are blocking access to the service account folder and only allowing it to /bin/cat.

It involves both blacklist and whitelist behaviour so you cannot change the DefaultPosture just to audit the access. You will need to change Block here to Audit if you want to Audit the behaviour instead of enforcing it.

It's confusing for me to understand. Since in the doc it's says https://github.com/kubearmor/KubeArmor/blob/event-auditor/getting-started/consideration_in_policy_action.md

Since Pod A has an 'Allow' policy and a 'Block' policy together, the way to handle those policies is changed from a blacklist manner to a whitelist manner,

Since my defaultposture is to block and after defining allow and block together it's whitelisted as describe in the docs. Is it possible to easily define? May be enforce defaultposture to block.

apiVersion: security.kubearmor.com/v1
kind: KubeArmorPolicy
metadata:
  name: test
  namespace: test
spec:
  severity: 7
  selector:
    matchLabels:
      repository: test
  file:
    matchDirectories:
      - dir: /run/secrets/
        recursive: true

      - dir: /run/secrets/
        recursive: true
        action: Allow
        fromSource:
          - path: /usr/local/bin/php
          - path: /usr/local/etc/php
          - path: /usr/local/lib/php
          - path: /usr/local/php

  action: Block

[janavenkat]

@daemon1024 looking forward for the reply.

[janavenkat]

@daemon1024 looking forward for the reply.

[daemon1024]

Hey @janavenkat, Sorry for the really late response

I am trying to find another example. For instance, a process cannot call a subprocess. It can execute itself, but it cannot call id.

A standard whitelisting policy would work here right?
Provided the subprocess is a seperate process all together, we don't allow it even if the parent process is allowed.

#1588 (comment)

I am not sure about the question here. What is it that is not achievable based on #1588 (comment)?