github.com/khulnasoft-lab/defsec@v1.0.5-0.20230827010352-5e9f46893d95/rules/kubernetes/policies/pss/baseline/3_specific_capabilities_added.rego (about)

     1  # METADATA
     2  # title: "Specific capabilities added"
     3  # description: "Adding NET_RAW or capabilities beyond the default set must be disallowed."
     4  # scope: package
     5  # schemas:
     6  # - input: schema["kubernetes"]
     7  # related_resources:
     8  # - https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline
     9  # custom:
    10  #   id: KSV022
    11  #   avd_id: AVD-KSV-0022
    12  #   severity: MEDIUM
    13  #   short_code: no-non-default-capabilities
    14  #   recommended_action: "Do not set spec.containers[*].securityContext.capabilities.add and spec.initContainers[*].securityContext.capabilities.add"
    15  #   input:
    16  #     selector:
    17  #     - type: kubernetes
    18  package builtin.kubernetes.KSV022
    19  
    20  import data.lib.kubernetes
    21  
    22  default failAdditionalCaps = false
    23  
    24  # Add allowed capabilities to this set
    25  allowed_caps = set()
    26  
    27  # getContainersWithDisallowedCaps returns a list of containers which have
    28  # additional capabilities not included in the allowed capabilities list
    29  getContainersWithDisallowedCaps[container] {
    30  	container := kubernetes.containers[_]
    31  	set_caps := {cap | cap := container.securityContext.capabilities.add[_]}
    32  	caps_not_allowed := set_caps - allowed_caps
    33  	count(caps_not_allowed) > 0
    34  }
    35  
    36  # cap_msg is a string of allowed capabilities to be print as part of deny message
    37  caps_msg = "" {
    38  	count(allowed_caps) == 0
    39  } else = msg {
    40  	msg := sprintf(" or set it to the following allowed values: %s", [concat(", ", allowed_caps)])
    41  }
    42  
    43  deny[res] {
    44  	output := getContainersWithDisallowedCaps[_]
    45  	msg := sprintf("Container '%s' of %s '%s' should not set 'securityContext.capabilities.add'%s", [output.name, kubernetes.kind, kubernetes.name, caps_msg])
    46  	res := result.new(msg, output)
    47  }