github.com/khulnasoft-lab/defsec@v1.0.5-0.20230827010352-5e9f46893d95/rules/kubernetes/policies/general/any_verb.rego (about) 1 # METADATA 2 # title: "No wildcard verb roles" 3 # description: "Check whether role permits wildcard verb on specific resources" 4 # scope: package 5 # schemas: 6 # - input: schema["kubernetes"] 7 # related_resources: 8 # - https://kubernetes.io/docs/concepts/security/rbac-good-practices/ 9 # custom: 10 # id: KSV045 11 # avd_id: AVD-KSV-0045 12 # severity: CRITICAL 13 # short_code: no-wildcard-verb-role 14 # recommended_action: "Create a role which does not permit wildcard verb on specific resources" 15 # input: 16 # selector: 17 # - type: kubernetes 18 package builtin.kubernetes.KSV045 19 20 import data.lib.kubernetes 21 import data.lib.utils 22 23 resourceRead := ["secrets", "pods", "deployments", "daemonsets", "statefulsets", "replicationcontrollers", "replicasets", "cronjobs", "jobs", "roles", "clusterroles", "rolebindings", "clusterrolebindings", "users", "groups"] 24 25 readKinds := ["Role", "ClusterRole"] 26 27 resourceAllowAnyVerbOnspecificResource[input.rules[ru]] { 28 some ru, r, v 29 input.kind == readKinds[_] 30 input.rules[ru].resources[r] == resourceRead[_] 31 input.rules[ru].verbs[v] == "*" 32 } 33 34 deny[res] { 35 badRule := resourceAllowAnyVerbOnspecificResource[_] 36 msg := "Role permits wildcard verb on specific resources" 37 res := result.new(msg, badRule) 38 }