policy rule validation failure for a valid policy

[nyrahul]

Bug Report

Trying to apply a policy with valid file.matchPaths rule, but it fails.

apiVersion: security.kubearmor.com/v1
kind: KubeArmorPolicy
metadata:
  name: autopol-system-1760649700
  namespace: default
spec:
  severity: 1
  selector:
    matchLabels:
      app: cartservice
  file:
    matchPaths:
    - path: /usr/lib/libstdc++.so.6.0.28
      fromSource:
      - path: /app/cartservice
  action: Block

Policy validation fails during policy apply giving following error:

❯ k apply -f sample.yaml
The KubeArmorPolicy "autopol-system-1760649700" is invalid: spec.file.matchPaths.path: Invalid value: "/usr/lib/libstdc++.so.6.0.28": spec.file.matchPaths.path in body should match '^\/([A-z0-9-_.]+\/)*([A-z0-9-_.]+)$'

The problem seems to be with the filename libstdc++.so.6.0.28. If I remove ++ from the filename then the policy apply works.

General Information

• Environment description (GKE, VM-Kubeadm, vagrant-dev-env, minikube, microk8s, ...)
  any
• Kernel version (run uname -a)
  any
• Orchestration system version in use (e.g. kubectl version, ...)
  any

To Reproduce

1. Install sample k8s cluster with kubearmor daemonset (follow deployment-guide).
2. Apply above yaml policy kubectl apply -f sample.yaml

Expected behavior

kubectl apply should return successfully and the policy should be applied.