Skip to content
This repository was archived by the owner on Oct 14, 2020. It is now read-only.

Commit 4695e1e

Browse files
fuhrmeisteryfuhrmeistery
authored
Merge pull request #129 from secureCodeBox/security-contexts
Add securityContexts to secureCodeBox Components
2 parents 7123845 + 1823a60 commit 4695e1e

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

48 files changed

+454
-133
lines changed

‎hook-sdk/nodejs/Dockerfile

+3-3
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,10 @@ RUN npm ci --production
55

66
FROM node:12-alpine
77
ARG NODE_ENV
8-
RUN addgroup -S app && adduser app -S -G app
8+
RUN addgroup --system --gid 1001 app && adduser app --system --uid 1001 --ingroup app
99
WORKDIR /home/app/hook-wrapper/
1010
COPY --from=build --chown=app:app /home/app/node_modules/ ./node_modules/
1111
COPY --chown=app:app ./hook-wrapper.js ./hook-wrapper.js
12-
USER app
12+
USER 1001
1313
ENV NODE_ENV ${NODE_ENV:-production}
14-
ENTRYPOINT ["node", "/home/app/hook-wrapper/hook-wrapper.js"]
14+
ENTRYPOINT ["node", "/home/app/hook-wrapper/hook-wrapper.js"]

‎lurcher/Dockerfile

-1
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,5 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 GO111MODULE=on go build -a -o lurcher
2020
FROM gcr.io/distroless/static:nonroot
2121
WORKDIR /
2222
COPY --from=builder /workspace/lurcher .
23-
USER nonroot:nonroot
2423

2524
ENTRYPOINT ["/lurcher"]

‎operator/Dockerfile

-1
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,5 @@ ENV TELEMETRY_ENABLED "true"
2828

2929
WORKDIR /
3030
COPY --from=builder /workspace/manager .
31-
USER nonroot:nonroot
3231

3332
ENTRYPOINT ["/manager"]

‎operator/README.md

+6-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ helm install securecodebox-operator secureCodeBox/operator
2424
| image.pullPolicy | string | `"Always"` | Image pull policy |
2525
| image.repository | string | `"docker.io/securecodebox/operator"` | The operator image repository |
2626
| image.tag | string | defaults to the charts version | Parser image tag |
27-
| lurcher.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy |
27+
| lurcher.image.pullPolicy | string | `"Always"` | Image pull policy |
2828
| lurcher.image.repository | string | `"docker.io/securecodebox/lurcher"` | The operator image repository |
2929
| lurcher.image.tag | string | defaults to the charts version | Parser image tag |
3030
| minio.defaultBucket.enabled | bool | `true` | |
@@ -38,5 +38,10 @@ helm install securecodebox-operator secureCodeBox/operator
3838
| s3.port | string | `nil` | |
3939
| s3.secretAttributeNames.accesskey | string | `"accesskey"` | |
4040
| s3.secretAttributeNames.secretkey | string | `"secretkey"` | |
41+
| securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated |
42+
| securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the operator container. They are not required |
43+
| securityContext.privileged | bool | `false` | Ensures that the operator container is not run in privileged mode |
44+
| securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system |
45+
| securityContext.runAsNonRoot | bool | `true` | Enforces that the Operator image is run as a non root user |
4146
| telemetryEnabled | bool | `true` | The Operator sends anonymous telemetry data, to give the team an overview how much the secureCodeBox is used. Find out more at https://www.securecodebox.io/telemetry |
4247

‎operator/controllers/execution/scans/hook_reconciler.go

+12-1
Original file line numberDiff line numberDiff line change
@@ -362,6 +362,8 @@ func (r *ScanReconciler) createJobForHook(hook *executionv1.ScanCompletionHook,
362362
labels["securecodebox.io/hook-name"] = hook.Name
363363

364364
var backOffLimit int32 = 3
365+
truePointer := true
366+
falsePointer := false
365367
job := &batch.Job{
366368
ObjectMeta: metav1.ObjectMeta{
367369
Annotations: make(map[string]string),
@@ -388,7 +390,7 @@ func (r *ScanReconciler) createJobForHook(hook *executionv1.ScanCompletionHook,
388390
Image: hook.Spec.Image,
389391
Args: cliArgs,
390392
Env: append(hook.Spec.Env, standardEnvVars...),
391-
ImagePullPolicy: "IfNotPresent",
393+
ImagePullPolicy: "Always",
392394
Resources: corev1.ResourceRequirements{
393395
Requests: corev1.ResourceList{
394396
corev1.ResourceCPU: resource.MustParse("200m"),
@@ -399,6 +401,15 @@ func (r *ScanReconciler) createJobForHook(hook *executionv1.ScanCompletionHook,
399401
corev1.ResourceMemory: resource.MustParse("200Mi"),
400402
},
401403
},
404+
SecurityContext: &corev1.SecurityContext{
405+
RunAsNonRoot: &truePointer,
406+
AllowPrivilegeEscalation: &falsePointer,
407+
ReadOnlyRootFilesystem: &truePointer,
408+
Privileged: &falsePointer,
409+
Capabilities: &corev1.Capabilities{
410+
Drop: []corev1.Capability{"all"},
411+
},
412+
},
402413
},
403414
},
404415
},

‎operator/controllers/execution/scans/parse_reconciler.go

+11
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,8 @@ func (r *ScanReconciler) startParser(scan *executionv1.Scan) error {
8080
labels["securecodebox.io/job-type"] = "parser"
8181
automountServiceAccountToken := true
8282
var backOffLimit int32 = 3
83+
truePointer := true
84+
falsePointer := false
8385
job := &batch.Job{
8486
ObjectMeta: metav1.ObjectMeta{
8587
Annotations: make(map[string]string),
@@ -133,6 +135,15 @@ func (r *ScanReconciler) startParser(scan *executionv1.Scan) error {
133135
corev1.ResourceMemory: resource.MustParse("200Mi"),
134136
},
135137
},
138+
SecurityContext: &corev1.SecurityContext{
139+
RunAsNonRoot: &truePointer,
140+
AllowPrivilegeEscalation: &falsePointer,
141+
ReadOnlyRootFilesystem: &truePointer,
142+
Privileged: &falsePointer,
143+
Capabilities: &corev1.Capabilities{
144+
Drop: []corev1.Capability{"all"},
145+
},
146+
},
136147
},
137148
},
138149
AutomountServiceAccountToken: &automountServiceAccountToken,

‎operator/controllers/execution/scans/scan_reconciler.go

+12
Original file line numberDiff line numberDiff line change
@@ -221,6 +221,9 @@ func (r *ScanReconciler) constructJobForScan(scan *executionv1.Scan, scanType *e
221221
return nil, fmt.Errorf("Unknown imagePull Policy for lurcher: %s", lurcherPullPolicyRaw)
222222
}
223223

224+
falsePointer := false
225+
truePointer := true
226+
224227
lurcherSidecar := &corev1.Container{
225228
Name: "lurcher",
226229
Image: lurcherImage,
@@ -260,6 +263,15 @@ func (r *ScanReconciler) constructJobForScan(scan *executionv1.Scan, scanType *e
260263
ReadOnly: true,
261264
},
262265
},
266+
SecurityContext: &corev1.SecurityContext{
267+
RunAsNonRoot: &truePointer,
268+
AllowPrivilegeEscalation: &falsePointer,
269+
ReadOnlyRootFilesystem: &truePointer,
270+
Privileged: &falsePointer,
271+
Capabilities: &corev1.Capabilities{
272+
Drop: []corev1.Capability{"all"},
273+
},
274+
},
263275
}
264276

265277
job.Spec.Template.Spec.Containers = append(job.Spec.Template.Spec.Containers, *lurcherSidecar)

‎operator/templates/manager/manager.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -77,4 +77,6 @@ spec:
7777
value: {{ .Values.lurcher.image.pullPolicy }}
7878
resources:
7979
{{- toYaml .Values.resources | nindent 12 }}
80+
securityContext:
81+
{{- toYaml .Values.securityContext | nindent 12 }}
8082
terminationGracePeriodSeconds: 10

‎operator/values.yaml

+15-1
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,20 @@ image:
1414
# image.pullPolicy -- Image pull policy
1515
pullPolicy: Always
1616

17+
securityContext:
18+
# securityContext.runAsNonRoot -- Enforces that the Operator image is run as a non root user
19+
runAsNonRoot: true
20+
# securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system
21+
readOnlyRootFilesystem: true
22+
# securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated
23+
allowPrivilegeEscalation: false
24+
# securityContext.privileged -- Ensures that the operator container is not run in privileged mode
25+
privileged: false
26+
capabilities:
27+
drop:
28+
# securityContext.capabilities.drop[0] -- This drops all linux privileges from the operator container. They are not required
29+
- all
30+
1731
lurcher:
1832
image:
1933
# lurcher.image.repository -- The operator image repository
@@ -22,7 +36,7 @@ lurcher:
2236
# @default -- defaults to the charts version
2337
tag: null
2438
# lurcher.image.pullPolicy -- Image pull policy
25-
pullPolicy: IfNotPresent
39+
pullPolicy: Always
2640

2741
minio:
2842
# minio.enabled Enable this to use minio as storage backend instead of a cloud bucket provider like AWS S3, Google Cloud Storage, DigitalOcean Spaces etc.

‎parser-sdk/nodejs/Dockerfile

+3-3
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,10 @@ RUN npm ci --production
55

66
FROM node:12-alpine
77
ARG NODE_ENV
8-
RUN addgroup -S app && adduser app -S -G app
8+
RUN addgroup --system --gid 1001 app && adduser app --system --uid 1001 --ingroup app
99
WORKDIR /home/app/parser-wrapper/
1010
COPY --from=build --chown=app:app /home/app/node_modules/ ./node_modules/
1111
COPY --chown=app:app ./parser-wrapper.js ./parser-wrapper.js
12-
USER app
12+
USER 1001
1313
ENV NODE_ENV ${NODE_ENV:-production}
14-
ENTRYPOINT ["node", "/home/app/parser-wrapper/parser-wrapper.js"]
14+
ENTRYPOINT ["node", "/home/app/parser-wrapper/parser-wrapper.js"]

‎scanners/amass/Chart.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ description: A Helm chart for the Amass security scanner that integrates with th
55
type: application
66
# version - gets automatically set to the secureCodeBox release version when the helm charts gets published
77
version: latest
8-
appVersion: 3.10.3
8+
appVersion: 3.10.4
99
kubeVersion: ">=v1.11.0"
1010

1111
keywords:

‎scanners/amass/README.md

+4-3
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ path: "scanners/amass"
44
category: "scanner"
55
type: "Network"
66
state: "released"
7-
appVersion: "3.10.3"
7+
appVersion: "3.10.4"
88
usecase: "Subdomain Enumeration Scanner"
99
---
1010

@@ -44,9 +44,10 @@ Special command line options:
4444
| parserImage.tag | string | defaults to the charts version | Parser image tag |
4545
| scannerJob.env | list | `[]` | Optional environment variables mapped into each scanJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) |
4646
| scannerJob.extraContainers | list | `[]` | Optional additional Containers started with each scanJob (see: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) |
47-
| scannerJob.extraVolumeMounts | list | `[]` | Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) |
48-
| scannerJob.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) |
47+
| scannerJob.extraVolumeMounts | list | `[{"mountPath":"/amass/output/config.ini","name":"amass-config","subPath":"config.ini"}]` | Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) |
48+
| scannerJob.extraVolumes | list | `[{"configMap":{"name":"amass-config"},"name":"amass-config"}]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) |
4949
| scannerJob.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) |
50+
| scannerJob.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) |
5051
| scannerJob.ttlSecondsAfterFinished | string | `nil` | Defines how long the scanner job after finishing will be available (see: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/) |
5152

5253
[owasp_amass_project]: https://owasp.org/www-project-amass/

‎scanners/amass/README.md.gotmpl

+1-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ path: "scanners/amass"
44
category: "scanner"
55
type: "Network"
66
state: "released"
7-
appVersion: "3.10.3"
7+
appVersion: "3.10.4"
88
usecase: "Subdomain Enumeration Scanner"
99
---
1010

‎scanners/amass/helm2.Chart.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ description: A Helm chart for the Amass security scanner that integrates with th
55
type: application
66
# version - gets automatically set to the secureCodeBox release version when the helm charts gets published
77
version: latest
8-
appVersion: 3.10.3
8+
appVersion: 3.10.4
99
kubeVersion: ">=v1.11.0"
1010

1111
keywords:

‎scanners/amass/templates/amass-scan-type.yaml

+10-7
Original file line numberDiff line numberDiff line change
@@ -24,16 +24,19 @@ spec:
2424
- "enum"
2525
- "-json"
2626
- "/home/securecodebox/amass-results.jsonl"
27-
volumeMounts:
28-
- name: "amass-config"
29-
mountPath: "/amass/output/config.ini"
30-
subPath: "config.ini"
3127
resources:
3228
{{- toYaml .Values.scannerJob.resources | nindent 16 }}
29+
securityContext:
30+
{{- toYaml .Values.scannerJob.securityContext | nindent 16 }}
31+
env:
32+
{{- toYaml .Values.scannerJob.env | nindent 16 }}
33+
volumeMounts:
34+
{{- toYaml .Values.scannerJob.extraVolumeMounts | nindent 16 }}
35+
{{- if .Values.scannerJob.extraContainers }}
36+
{{- toYaml .Values.scannerJob.extraContainers | nindent 12 }}
37+
{{- end }}
3338
volumes:
34-
- name: "amass-config"
35-
configMap:
36-
name: "amass-config"
39+
{{- toYaml .Values.scannerJob.extraVolumeMounts | nindent 12 }}
3740
---
3841
apiVersion: v1
3942
kind: ConfigMap

‎scanners/amass/values.yaml

+19-10
Original file line numberDiff line numberDiff line change
@@ -12,22 +12,31 @@ scannerJob:
1212

1313
# scannerJob.resources -- CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/)
1414
resources: {}
15-
# resources:
16-
# requests:
17-
# memory: "256Mi"
18-
# cpu: "250m"
19-
# limits:
20-
# memory: "512Mi"
21-
# cpu: "500m"
15+
# resources:
16+
# requests:
17+
# memory: "256Mi"
18+
# cpu: "250m"
19+
# limits:
20+
# memory: "512Mi"
21+
# cpu: "500m"
2222

2323
# scannerJob.env -- Optional environment variables mapped into each scanJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/)
2424
env: []
2525

2626
# scannerJob.extraVolumes -- Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/)
27-
extraVolumes: []
27+
extraVolumes:
28+
- name: "amass-config"
29+
configMap:
30+
name: "amass-config"
2831

2932
# scannerJob.extraVolumeMounts -- Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/)
30-
extraVolumeMounts: []
33+
extraVolumeMounts:
34+
- name: "amass-config"
35+
mountPath: "/amass/output/config.ini"
36+
subPath: "config.ini"
3137

3238
# scannerJob.extraContainers -- Optional additional Containers started with each scanJob (see: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/)
33-
extraContainers: []
39+
extraContainers: []
40+
41+
# scannerJob.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)
42+
securityContext: {}

‎scanners/kube-hunter/README.md

+1
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ The following security scan configuration example are based on the [kube-hunter
4343
| scannerJob.extraVolumeMounts | list | `[]` | Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) |
4444
| scannerJob.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) |
4545
| scannerJob.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) |
46+
| scannerJob.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) |
4647
| scannerJob.ttlSecondsAfterFinished | string | `nil` | Defines how long the scanner job after finishing will be available (see: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/) |
4748

4849
[kube-hunter Website]: https://kube-hunter.aquasec.com/

‎scanners/kube-hunter/templates/kubehunter-scan-type.yaml

+11
Original file line numberDiff line numberDiff line change
@@ -24,3 +24,14 @@ spec:
2424
- 'json'
2525
resources:
2626
{{- toYaml .Values.scannerJob.resources | nindent 16 }}
27+
securityContext:
28+
{{- toYaml .Values.scannerJob.securityContext | nindent 16 }}
29+
env:
30+
{{- toYaml .Values.scannerJob.env | nindent 16 }}
31+
volumeMounts:
32+
{{- toYaml .Values.scannerJob.extraVolumeMounts | nindent 16 }}
33+
{{- if .Values.scannerJob.extraContainers }}
34+
{{- toYaml .Values.scannerJob.extraContainers | nindent 12 }}
35+
{{- end }}
36+
volumes:
37+
{{- toYaml .Values.scannerJob.extraVolumes | nindent 12 }}

‎scanners/kube-hunter/values.yaml

+10-7
Original file line numberDiff line numberDiff line change
@@ -17,13 +17,13 @@ scannerJob:
1717

1818
# scannerJob.resources -- CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/)
1919
resources: {}
20-
# resources:
21-
# requests:
22-
# memory: "256Mi"
23-
# cpu: "250m"
24-
# limits:
25-
# memory: "512Mi"
26-
# cpu: "500m"
20+
# resources:
21+
# requests:
22+
# memory: "256Mi"
23+
# cpu: "250m"
24+
# limits:
25+
# memory: "512Mi"
26+
# cpu: "500m"
2727

2828
# scannerJob.env -- Optional environment variables mapped into each scanJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/)
2929
env: []
@@ -36,3 +36,6 @@ scannerJob:
3636

3737
# scannerJob.extraContainers -- Optional additional Containers started with each scanJob (see: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/)
3838
extraContainers: []
39+
40+
# scannerJob.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)
41+
securityContext: {}

‎scanners/ncrack/README.md

+1
Original file line numberDiff line numberDiff line change
@@ -151,6 +151,7 @@ SEE THE MAN PAGE (http://nmap.org/ncrack/man.html) FOR MORE OPTIONS AND EXAMPLES
151151
| scannerJob.extraVolumeMounts | list | `[]` | Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) |
152152
| scannerJob.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) |
153153
| scannerJob.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) |
154+
| scannerJob.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) |
154155
| scannerJob.ttlSecondsAfterFinished | string | `nil` | Defines how long the scanner job after finishing will be available (see: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/) |
155156

156157
---

‎scanners/ncrack/templates/ncrack-scan-type.yaml

+7
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,15 @@ spec:
2121
command: ["ncrack", "-oX", "/home/securecodebox/ncrack-results.xml"]
2222
resources:
2323
{{- toYaml .Values.scannerJob.resources | nindent 16 }}
24+
securityContext:
25+
{{- toYaml .Values.scannerJob.securityContext | nindent 16 }}
26+
env:
27+
{{- toYaml .Values.scannerJob.env | nindent 16 }}
2428
volumeMounts:
2529
{{- toYaml .Values.scannerJob.extraVolumeMounts | nindent 16 }}
30+
{{- if .Values.scannerJob.extraContainers }}
31+
{{- toYaml .Values.scannerJob.extraContainers | nindent 12 }}
32+
{{- end }}
2633
volumes:
2734
{{- toYaml .Values.scannerJob.extraVolumes | nindent 12 }}
2835

0 commit comments

Comments
 (0)