Merge pull request #136 from microsoft/danmihai1/copy-file

genpolicy: reject some of the CopyFile requests
microsoft · Dec 22, 2023 · 80b0055 · 80b0055
2 parents 5b285e1 + cb30ed8
commit 80b0055
Show file tree

Hide file tree

Showing 60 changed files with 73 additions and 62 deletions.
diff --git a/src/agent/samples/policy/yaml/configmap/pod-cm1.yaml b/src/agent/samples/policy/yaml/configmap/pod-cm1.yaml
diff --git a/src/agent/samples/policy/yaml/configmap/pod-cm2.yaml b/src/agent/samples/policy/yaml/configmap/pod-cm2.yaml
diff --git a/src/agent/samples/policy/yaml/deployment/deployment-azure-vote-back.yaml b/src/agent/samples/policy/yaml/deployment/deployment-azure-vote-back.yaml
diff --git a/src/agent/samples/policy/yaml/deployment/deployment-azure-vote-front.yaml b/src/agent/samples/policy/yaml/deployment/deployment-azure-vote-front.yaml
diff --git a/src/agent/samples/policy/yaml/deployment/deployment-busybox.yaml b/src/agent/samples/policy/yaml/deployment/deployment-busybox.yaml
diff --git a/src/agent/samples/policy/yaml/deployment/deployment-docker-busybox.yaml b/src/agent/samples/policy/yaml/deployment/deployment-docker-busybox.yaml
diff --git a/src/agent/samples/policy/yaml/job/test-job.yaml b/src/agent/samples/policy/yaml/job/test-job.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/conformance/conformance-e2e.yaml b/src/agent/samples/policy/yaml/kubernetes/conformance/conformance-e2e.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/conformance/csi-hostpath-plugin.yaml b/src/agent/samples/policy/yaml/kubernetes/conformance/csi-hostpath-plugin.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/conformance/csi-hostpath-testing.yaml b/src/agent/samples/policy/yaml/kubernetes/conformance/csi-hostpath-testing.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/conformance/etcd-statefulset.yaml b/src/agent/samples/policy/yaml/kubernetes/conformance/etcd-statefulset.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/conformance/hello-populator-deploy.yaml b/src/agent/samples/policy/yaml/kubernetes/conformance/hello-populator-deploy.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/conformance/netexecrc.yaml b/src/agent/samples/policy/yaml/kubernetes/conformance/netexecrc.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/conformance2/ingress-http-rc.yaml b/src/agent/samples/policy/yaml/kubernetes/conformance2/ingress-http-rc.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/conformance2/ingress-http2-rc.yaml b/src/agent/samples/policy/yaml/kubernetes/conformance2/ingress-http2-rc.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/conformance2/ingress-multiple-certs-rc.yaml b/src/agent/samples/policy/yaml/kubernetes/conformance2/ingress-multiple-certs-rc.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/conformance2/ingress-nginx-rc.yaml b/src/agent/samples/policy/yaml/kubernetes/conformance2/ingress-nginx-rc.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/conformance2/ingress-static-ip-rc.yaml b/src/agent/samples/policy/yaml/kubernetes/conformance2/ingress-static-ip-rc.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/fixtures/appsv1deployment.yaml b/src/agent/samples/policy/yaml/kubernetes/fixtures/appsv1deployment.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/fixtures/daemon.yaml b/src/agent/samples/policy/yaml/kubernetes/fixtures/daemon.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/fixtures/deploy-clientside.yaml b/src/agent/samples/policy/yaml/kubernetes/fixtures/deploy-clientside.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/fixtures/job.yaml b/src/agent/samples/policy/yaml/kubernetes/fixtures/job.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/fixtures/multi-resource-yaml.yaml b/src/agent/samples/policy/yaml/kubernetes/fixtures/multi-resource-yaml.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/fixtures/rc-lastapplied.yaml b/src/agent/samples/policy/yaml/kubernetes/fixtures/rc-lastapplied.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/fixtures/rc-noexist.yaml b/src/agent/samples/policy/yaml/kubernetes/fixtures/rc-noexist.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/fixtures/replication.yaml b/src/agent/samples/policy/yaml/kubernetes/fixtures/replication.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/fixtures2/rc-service.yaml b/src/agent/samples/policy/yaml/kubernetes/fixtures2/rc-service.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/fixtures2/valid-pod.yaml b/src/agent/samples/policy/yaml/kubernetes/fixtures2/valid-pod.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/incomplete-init/cassandra-statefulset.yaml b/src/agent/samples/policy/yaml/kubernetes/incomplete-init/cassandra-statefulset.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/incomplete-init/cockroachdb-statefulset.yaml b/src/agent/samples/policy/yaml/kubernetes/incomplete-init/cockroachdb-statefulset.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/incomplete-init/controller.yaml b/src/agent/samples/policy/yaml/kubernetes/incomplete-init/controller.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/incomplete-init/node_ds.yaml b/src/agent/samples/policy/yaml/kubernetes/incomplete-init/node_ds.yaml
diff --git a/src/agent/samples/policy/yaml/pod/pod-exec.yaml b/src/agent/samples/policy/yaml/pod/pod-exec.yaml
diff --git a/src/agent/samples/policy/yaml/pod/pod-lifecycle.yaml b/src/agent/samples/policy/yaml/pod/pod-lifecycle.yaml
diff --git a/src/agent/samples/policy/yaml/pod/pod-one-container.yaml b/src/agent/samples/policy/yaml/pod/pod-one-container.yaml
diff --git a/src/agent/samples/policy/yaml/pod/pod-persistent-volumes.yaml b/src/agent/samples/policy/yaml/pod/pod-persistent-volumes.yaml
diff --git a/src/agent/samples/policy/yaml/pod/pod-same-containers.yaml b/src/agent/samples/policy/yaml/pod/pod-same-containers.yaml
diff --git a/src/agent/samples/policy/yaml/pod/pod-spark.yaml b/src/agent/samples/policy/yaml/pod/pod-spark.yaml
diff --git a/src/agent/samples/policy/yaml/pod/pod-three-containers.yaml b/src/agent/samples/policy/yaml/pod/pod-three-containers.yaml
diff --git a/src/agent/samples/policy/yaml/pod/pod-ubuntu.yaml b/src/agent/samples/policy/yaml/pod/pod-ubuntu.yaml
diff --git a/src/agent/samples/policy/yaml/replica-set/replica-busy.yaml b/src/agent/samples/policy/yaml/replica-set/replica-busy.yaml
diff --git a/src/agent/samples/policy/yaml/secrets/azure-file-secrets.yaml b/src/agent/samples/policy/yaml/secrets/azure-file-secrets.yaml
diff --git a/src/agent/samples/policy/yaml/stateful-set/web.yaml b/src/agent/samples/policy/yaml/stateful-set/web.yaml
diff --git a/src/agent/samples/policy/yaml/webhook/webhook-pod1.yaml b/src/agent/samples/policy/yaml/webhook/webhook-pod1.yaml
diff --git a/src/agent/samples/policy/yaml/webhook/webhook-pod2.yaml b/src/agent/samples/policy/yaml/webhook/webhook-pod2.yaml
diff --git a/src/agent/samples/policy/yaml/webhook/webhook-pod3.yaml b/src/agent/samples/policy/yaml/webhook/webhook-pod3.yaml
diff --git a/src/agent/samples/policy/yaml/webhook/webhook-pod4.yaml b/src/agent/samples/policy/yaml/webhook/webhook-pod4.yaml
diff --git a/src/agent/samples/policy/yaml/webhook/webhook-pod5.yaml b/src/agent/samples/policy/yaml/webhook/webhook-pod5.yaml
diff --git a/src/agent/samples/policy/yaml/webhook/webhook-pod6.yaml b/src/agent/samples/policy/yaml/webhook/webhook-pod6.yaml
diff --git a/src/agent/samples/policy/yaml/webhook/webhook-pod7.yaml b/src/agent/samples/policy/yaml/webhook/webhook-pod7.yaml
diff --git a/src/agent/samples/policy/yaml/webhook2/webhook-pod10.yaml b/src/agent/samples/policy/yaml/webhook2/webhook-pod10.yaml
diff --git a/src/agent/samples/policy/yaml/webhook2/webhook-pod11.yaml b/src/agent/samples/policy/yaml/webhook2/webhook-pod11.yaml
diff --git a/src/agent/samples/policy/yaml/webhook2/webhook-pod12.yaml b/src/agent/samples/policy/yaml/webhook2/webhook-pod12.yaml
diff --git a/src/agent/samples/policy/yaml/webhook2/webhook-pod13.yaml b/src/agent/samples/policy/yaml/webhook2/webhook-pod13.yaml
diff --git a/src/agent/samples/policy/yaml/webhook2/webhook-pod8.yaml b/src/agent/samples/policy/yaml/webhook2/webhook-pod8.yaml
diff --git a/src/agent/samples/policy/yaml/webhook2/webhook-pod9.yaml b/src/agent/samples/policy/yaml/webhook2/webhook-pod9.yaml
diff --git a/src/agent/samples/policy/yaml/webhook3/dns-test.yaml b/src/agent/samples/policy/yaml/webhook3/dns-test.yaml
diff --git a/src/agent/samples/policy/yaml/webhook3/many-layers.yaml b/src/agent/samples/policy/yaml/webhook3/many-layers.yaml
diff --git a/src/tools/genpolicy/genpolicy-settings.json b/src/tools/genpolicy/genpolicy-settings.json
@@ -279,7 +279,7 @@
             ]
         },
         "CopyFileRequest": [
-            "^$(cpath)/"
+            "$(sfprefix)"
         ],
         "ExecProcessRequest": {
             "commands": [],

diff --git a/src/tools/genpolicy/rules.rego b/src/tools/genpolicy/rules.rego
@@ -1060,12 +1060,23 @@ match_caps(p_caps, i_caps) {
 }
 
 ######################################################################
+check_directory_traversal(i_path) {
+    contains(i_path, "../") == false
+    endswith(i_path, "/..") == false
+}
+
 CopyFileRequest {
     print("CopyFileRequest: input.path =", input.path)
 
+    check_directory_traversal(input.path)
+
     some regex1 in policy_data.request_defaults.CopyFileRequest
-    regex2 := replace(regex1, "$(cpath)", policy_data.common.cpath)
-    regex.match(regex2, input.path)
+    regex2 := replace(regex1, "$(sfprefix)", policy_data.common.sfprefix)
+    regex3 := replace(regex2, "$(cpath)", policy_data.common.cpath)
+    regex4 := replace(regex3, "$(bundle-id)", "[a-z0-9]{64}")
+    print("CopyFileRequest: regex4 =", regex4)
+
+    regex.match(regex4, input.path)
 
     print("CopyFileRequest: true")
 }