Skip to content

Commit

Permalink
Merge pull request #508 from kubescape/delete-review-path
Browse files Browse the repository at this point in the history 
start adding delete / review paths
  • Loading branch information
@YiscahLevySilas1
YiscahLevySilas1 authored Oct 1, 2023
2 parents 96b1f7e + 4b3e94e commit a001a50
Show file tree
Hide file tree
Showing 16 changed files with 33 additions and 0 deletions.
3 changes: 3 additions & 0 deletions rules/CVE-2021-25741/raw.rego
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ deny[msga] {
msga := {
"alertMessage": sprintf("You may be vulnerable to CVE-2021-25741. You have a Node with a vulnerable version and the following container : %v in pod : %v with subPath/subPathExpr", [container.name, pod.metadata.name]),
"alertObject": {"k8SApiObjects": [pod]},
"deletePaths": final_path,
"failedPaths": final_path,
"fixPaths": [],
}
Expand All @@ -34,6 +35,7 @@ deny[msga] {
msga := {
"alertMessage": sprintf("You may be vulnerable to CVE-2021-25741. You have a Node with a vulnerable version and the following container : %v in %v : %v with subPath/subPathExpr", [container.name, wl.kind, wl.metadata.name]),
"alertObject": {"k8SApiObjects": [wl]},
"deletePaths": final_path,
"failedPaths": final_path,
"fixPaths": [],
}
Expand All @@ -54,6 +56,7 @@ deny[msga] {
msga := {
"alertMessage": sprintf("You may be vulnerable to CVE-2021-25741. You have a Node with a vulnerable version and the following container : %v in %v : %v with subPath/subPathExpr", [container.name, wl.kind, wl.metadata.name]),
"alertObject": {"k8SApiObjects": [wl]},
"deletePaths": final_path,
"failedPaths": final_path,
"fixPaths": [],
}
Expand Down
3 changes: 3 additions & 0 deletions rules/alert-any-hostpath/raw.rego
View file
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ deny[msga] {
"alertMessage": sprintf("pod: %v has: %v as hostPath volume", [podname, volume.name]),
"packagename": "armo_builtins",
"alertScore": 7,
"deletePaths": [result],
"failedPaths": [result],
"fixPaths":[],
"alertObject": {
Expand All @@ -38,6 +39,7 @@ deny[msga] {
"alertMessage": sprintf("%v: %v has: %v as hostPath volume", [wl.kind, wl.metadata.name, volume.name]),
"packagename": "armo_builtins",
"alertScore": 7,
"deletePaths": [result],
"failedPaths": [result],
"fixPaths":[],
"alertObject": {
Expand All @@ -58,6 +60,7 @@ deny[msga] {
"alertMessage": sprintf("%v: %v has: %v as hostPath volume", [wl.kind, wl.metadata.name, volume.name]),
"packagename": "armo_builtins",
"alertScore": 7,
"deletePaths": [result],
"failedPaths": [result],
"fixPaths":[],
"alertObject": {
Expand Down
1 change: 1 addition & 0 deletions rules/alert-container-optimized-os-not-in-use/raw.rego
View file
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@ deny[msga] {
"packagename": "armo_builtins",

"alertScore": 7,
"reviewPaths": failedPaths,
"failedPaths": failedPaths,
"fixPaths": [],
"alertObject": {
Expand Down
1 change: 1 addition & 0 deletions rules/alert-mount-potential-credentials-paths/raw.rego
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@ deny[msga] {
"alertMessage": sprintf("%v: %v has: %v as volume with potential credentials access.", [resources.kind, resources.metadata.name, volume.name]),
"packagename": "armo_builtins",
"alertScore": 7,
"deletePaths": [result],
"failedPaths": [result],
"fixPaths":[],
"alertObject": {
Expand Down
3 changes: 3 additions & 0 deletions rules/alert-rw-hostpath/raw.rego
View file
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ deny[msga] {
"packagename": "armo_builtins",
"alertScore": 7,
"fixPaths": fixed_path,
"deletePaths": failed_path,
"failedPaths": failed_path,
"alertObject": {
"k8sApiObjects": [pod]
Expand Down Expand Up @@ -51,6 +52,7 @@ deny[msga] {
"packagename": "armo_builtins",
"alertScore": 7,
"fixPaths": fixed_path,
"deletePaths": failed_path,
"failedPaths": failed_path,
"alertObject": {
"k8sApiObjects": [wl]
Expand Down Expand Up @@ -81,6 +83,7 @@ deny[msga] {
"packagename": "armo_builtins",
"alertScore": 7,
"fixPaths": fixed_path,
"deletePaths": failed_path,
"failedPaths": failed_path,
"alertObject": {
"k8sApiObjects": [wl]
Expand Down
1 change: 1 addition & 0 deletions rules/anonymous-requests-to-kubelet-updated/raw.rego
View file
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,7 @@ deny[msga] {
msga := {
"alertMessage": "Anonymous requests is enabled.",
"alertScore": 7,
"reviewPaths": ["authentication.anonymous.enabled"],
"failedPaths": ["authentication.anonymous.enabled"],
"fixPaths": [],
"packagename": "armo_builtins",
Expand Down
1 change: 1 addition & 0 deletions rules/automount-default-service-account/raw.rego
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ deny [msga]{
"alertScore": 9,
"packagename": "armo_builtins",
"fixPaths": fixed_path,
"deletePaths": failed_path,
"failedPaths": failed_path,
"alertObject": {
"k8sApiObjects": [service_account]
Expand Down
4 changes: 4 additions & 0 deletions rules/automount-service-account/raw.rego
View file
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ deny [msga]{
"alertScore": 9,
"packagename": "armo_builtins",
"fixPaths": fixed_path,
"deletePaths": failed_path,
"failedPaths": failed_path,
"alertObject": {
"k8sApiObjects": [service_account]
Expand Down Expand Up @@ -40,6 +41,7 @@ deny [msga]{
"alertScore": 9,
"packagename": "armo_builtins",
"fixPaths": fixed_path,
"deletePaths": failed_path,
"failedPaths": failed_path,
"alertObject": {
"k8sApiObjects": [pod]
Expand All @@ -64,6 +66,7 @@ deny[msga] {
"packagename": "armo_builtins",
"alertScore": 7,
"fixPaths": fixed_path,
"deletePaths": failed_path,
"failedPaths": failed_path,
"alertObject": {
"k8sApiObjects": [wl]
Expand All @@ -88,6 +91,7 @@ deny[msga] {
"packagename": "armo_builtins",
"alertScore": 7,
"fixPaths": fixed_path,
"deletePaths": failed_path,
"failedPaths": failed_path,
"alertObject": {
"k8sApiObjects": [wl]
Expand Down
1 change: 1 addition & 0 deletions rules/cluster-admin-role/raw.rego
View file
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,7 @@ deny[msga] {
"alertMessage": sprintf("Subject: %s-%s is bound to cluster-admin role", [subjectVector.kind, subjectVector.name]),
"alertScore": 3,
"fixPaths": [],
"deletePaths": finalpath,
"failedPaths": finalpath,
"packagename": "armo_builtins",
"alertObject": {
Expand Down
1 change: 1 addition & 0 deletions rules/configmap-in-default-namespace/raw.rego
View file
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ deny[msga] {
"alertMessage": sprintf("%v: %v is in the 'default' namespace", [resource.kind, resource.metadata.name]),
"packagename": "armo_builtins",
"alertScore": 3,
"reviewPaths": failed_path,
"failedPaths": failed_path,
"fixPaths": fixed_path,
"alertObject": {
Expand Down
3 changes: 3 additions & 0 deletions rules/container-hostPort/raw.rego
View file
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ deny[msga] {
"alertMessage": sprintf("Container: %v has Host-port", [ container.name]),
"packagename": "armo_builtins",
"alertScore": 4,
"deletePaths": path,
"failedPaths": path,
"fixPaths":[],
"alertObject": {
Expand All @@ -32,6 +33,7 @@ deny[msga] {
"alertMessage": sprintf("Container: %v in %v: %v has Host-port", [ container.name, wl.kind, wl.metadata.name]),
"packagename": "armo_builtins",
"alertScore": 4,
"deletePaths": path,
"failedPaths": path,
"fixPaths":[],
"alertObject": {
Expand All @@ -51,6 +53,7 @@ deny[msga] {
"alertMessage": sprintf("Container: %v in %v: %v has Host-port", [ container.name, wl.kind, wl.metadata.name]),
"packagename": "armo_builtins",
"alertScore": 4,
"deletePaths": path,
"failedPaths": path,
"fixPaths":[],
"alertObject": {
Expand Down
1 change: 1 addition & 0 deletions rules/container-image-repository-v1/raw.rego
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ untrustedImageRepo[msga] {
"packagename": "armo_builtins",
"alertScore": 2,
"fixPaths": [],
"reviewPaths": [path],
"failedPaths": [path],
"alertObject": {"k8sApiObjects": [wl]},
}
Expand Down
3 changes: 3 additions & 0 deletions rules/container-image-repository/raw.rego
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ untrusted_image_repo[msga] {
"alertMessage": sprintf("image '%v' in container '%s' comes from untrusted registry", [image, container.name]),
"alertScore": 2,
"packagename": "armo_builtins",
"reviewPaths": [path],
"failedPaths": [path],
"fixPaths":[],
"alertObject": {
Expand All @@ -35,6 +36,7 @@ untrusted_image_repo[msga] {
"alertMessage": sprintf("image '%v' in container '%s' comes from untrusted registry", [image, container.name]),
"alertScore": 2,
"packagename": "armo_builtins",
"reviewPaths": [path],
"failedPaths": [path],
"fixPaths":[],
"alertObject": {
Expand All @@ -55,6 +57,7 @@ untrusted_image_repo[msga] {
"alertMessage": sprintf("image '%v' in container '%s' comes from untrusted registry", [image, container.name]),
"alertScore": 2,
"packagename": "armo_builtins",
"reviewPaths": [path],
"failedPaths": [path],
"fixPaths":[],
"alertObject": {
Expand Down
3 changes: 3 additions & 0 deletions rules/containers-mounting-docker-socket/raw.rego
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@ deny[msga] {
msga := {
"alertMessage": sprintf("volume: %v in pod: %v has mounting to Docker internals.", [volume.name, pod.metadata.name]),
"packagename": "armo_builtins",
"deletePaths": [path],
"failedPaths": [path],
"fixPaths":[],
"alertScore": 5,
Expand All @@ -33,6 +34,7 @@ deny[msga] {
msga := {
"alertMessage": sprintf("volume: %v in %v: %v has mounting to Docker internals.", [ volume.name, wl.kind, wl.metadata.name]),
"packagename": "armo_builtins",
"deletePaths": [path],
"failedPaths": [path],
"fixPaths":[],
"alertScore": 5,
Expand All @@ -53,6 +55,7 @@ deny[msga] {
msga := {
"alertMessage": sprintf("volume: %v in %v: %v has mounting to Docker internals.", [ volume.name, wl.kind, wl.metadata.name]),
"packagename": "armo_builtins",
"deletePaths": [path],
"failedPaths": [path],
"fixPaths":[],
"alertScore": 5,
Expand Down
1 change: 1 addition & 0 deletions rules/csistoragecapacity-in-default-namespace/raw.rego
View file
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ deny[msga] {
"alertMessage": sprintf("%v: %v is in the 'default' namespace", [resource.kind, resource.metadata.name]),
"packagename": "armo_builtins",
"alertScore": 3,
"reviewPaths": failed_path,
"failedPaths": failed_path,
"fixPaths": fixed_path,
"alertObject": {
Expand Down
3 changes: 3 additions & 0 deletions rules/insecure-capabilities/raw.rego
View file
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ deny[msga] {
"alertMessage": sprintf("container: %v in pod: %v have dangerous capabilities", [container.name, pod.metadata.name]),
"packagename": "armo_builtins",
"alertScore": 7,
"deletePaths": result,
"failedPaths": result,
"fixPaths": [],
"alertObject": {
Expand All @@ -31,6 +32,7 @@ deny[msga] {
"alertMessage": sprintf("container: %v in workload: %v have dangerous capabilities", [container.name, wl.metadata.name]),
"packagename": "armo_builtins",
"alertScore": 7,
"deletePaths": result,
"failedPaths": result,
"fixPaths": [],
"alertObject": {
Expand All @@ -49,6 +51,7 @@ deny[msga] {
"alertMessage": sprintf("container: %v in cronjob: %v have dangerous capabilities", [container.name, wl.metadata.name]),
"packagename": "armo_builtins",
"alertScore": 7,
"deletePaths": result,
"failedPaths": result,
"fixPaths": [],
"alertObject": {
Expand Down

0 comments on commit a001a50

Please sign in to comment.