Improve the SetPolicy and CopyFile policy behavior #137
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Don't release the lock between is_allowed and set_policy calls, because the policy might change in between these calls. Also, move more policy code into policy.rs. Fixes: kata-containers#8734 Signed-off-by: Dan Mihai <[email protected]>
1. When creating a symbolic link, the symlink_src field is a string representation of the data bytes vector from CopyFileRequest. It's easier to verity a string compared with a bytes vector in OPA. 2. When not creating a symbolic link, the data bytes field from CopyFileRequest is not present in PolicyCopyFileRequest, because it might be large and probably unused by OPA. Signed-off-by: Dan Mihai <[email protected]>
danmihai1
force-pushed
the
danmihai1/copy-file
branch
from
10405a9 to
fd55586
Compare
Don't allow symlinks pointing outside of the Guest /run/kata-containers/shared/containers/<...> path. Signed-off-by: Dan Mihai <[email protected]>
Update policy samples after rules.rego change. Signed-off-by: Dan Mihai <[email protected]>
danmihai1
force-pushed
the
danmihai1/copy-file
branch
from
fd55586 to
07aa085
Compare
Redent0r
added
upstream/merged
Redent0r
added
upstream/missing
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
agent: improve policy handling of CopyFile
genpolicy: block some symlink create requests
agent: Don't release the lock between is_allowed and set_policy calls,