github.com/khulnasoft-lab/defsec@v1.0.5-0.20230827010352-5e9f46893d95/rules/kubernetes/policies/pss/baseline/9_unsafe_sysctl_options_set_test.rego (about) 1 package builtin.kubernetes.KSV026 2 3 test_sysctls_restricted_property_denied { 4 r := deny with input as { 5 "apiVersion": "v1", 6 "kind": "Pod", 7 "metadata": {"name": "hello-sysctls"}, 8 "spec": { 9 "securityContext": {"sysctls": [ 10 { 11 "name": "net.core.somaxconn", 12 "value": "1024", 13 }, 14 { 15 "name": "kernel.msgmax", 16 "value": "65536", 17 }, 18 ]}, 19 "containers": [{ 20 "command": [ 21 "sh", 22 "-c", 23 "echo 'Hello' && sleep 1h", 24 ], 25 "image": "busybox", 26 "name": "hello", 27 }], 28 }, 29 } 30 31 count(r) == 1 32 r[_].msg == "Pod 'hello-sysctls' should set 'securityContext.sysctl' to the allowed values" 33 } 34 35 test_sysctls_not_restricted_property_mixed_with_restriced_denied { 36 r := deny with input as { 37 "apiVersion": "v1", 38 "kind": "Pod", 39 "metadata": {"name": "hello-sysctls"}, 40 "spec": { 41 "securityContext": {"sysctls": [ 42 { 43 "name": "kernel.shm_rmid_forced", 44 "value": "0", 45 }, 46 { 47 "name": "net.core.somaxconn", 48 "value": "1024", 49 }, 50 { 51 "name": "kernel.msgmax", 52 "value": "65536", 53 }, 54 ]}, 55 "containers": [{ 56 "command": [ 57 "sh", 58 "-c", 59 "echo 'Hello' && sleep 1h", 60 ], 61 "image": "busybox", 62 "name": "hello", 63 }], 64 }, 65 } 66 67 count(r) == 1 68 r[_].msg == "Pod 'hello-sysctls' should set 'securityContext.sysctl' to the allowed values" 69 } 70 71 test_sysctls_not_restricted_property_allowed { 72 r := deny with input as { 73 "apiVersion": "v1", 74 "kind": "Pod", 75 "metadata": {"name": "hello-sysctls"}, 76 "spec": { 77 "securityContext": {"sysctls": [{ 78 "name": "kernel.shm_rmid_forced", 79 "value": "0", 80 }]}, 81 "containers": [{ 82 "command": [ 83 "sh", 84 "-c", 85 "echo 'Hello' && sleep 1h", 86 ], 87 "image": "busybox", 88 "name": "hello", 89 }], 90 }, 91 } 92 93 count(r) == 0 94 } 95 96 test_sysctls_is_undefined_allowed { 97 r := deny with input as { 98 "apiVersion": "v1", 99 "kind": "Pod", 100 "metadata": {"name": "hello-sysctls"}, 101 "spec": { 102 "securityContext": {}, 103 "containers": [{ 104 "command": [ 105 "sh", 106 "-c", 107 "echo 'Hello' && sleep 1h", 108 ], 109 "image": "busybox", 110 "name": "hello", 111 }], 112 }, 113 } 114 115 count(r) == 0 116 }