genpolicy: deny UpdateEphemeralMountsRequest

src/tools/genpolicy/genpolicy-settings.json

@@ -286,6 +286,7 @@
             "regex": []
         },
         "ReadStreamRequest": true,
+        "UpdateEphemeralMountsRequest": false,
         "WriteStreamRequest": false
     }
 }

src/tools/genpolicy/rules.rego

@@ -22,7 +22,7 @@ default SignalProcessRequest := true
 default StartContainerRequest := true
 default StatsContainerRequest := true
 default TtyWinResizeRequest := true
-default UpdateEphemeralMountsRequest := true
+default UpdateEphemeralMountsRequest := false
 default UpdateInterfaceRequest := true
 default UpdateRoutesRequest := true
 default WaitProcessRequest := true
@@ -1115,6 +1115,10 @@ ReadStreamRequest {
     policy_data.request_defaults.ReadStreamRequest == true
 }
 
+UpdateEphemeralMountsRequest {
+    policy_data.request_defaults.UpdateEphemeralMountsRequest == true
+}
+
 WriteStreamRequest {
     policy_data.request_defaults.WriteStreamRequest == true
 }

src/tools/genpolicy/src/policy.rs

@@ -324,6 +324,9 @@ pub struct RequestDefaults {
     /// Allow Host reading from Guest containers stdout and stderr.
     pub ReadStreamRequest: bool,
 
+    /// Allow Host to update Guest mounts.
+    pub UpdateEphemeralMountsRequest: bool,
+
     /// Allow Host writing to Guest containers stdin.
     pub WriteStreamRequest: bool,
 }