truecharts/library-charts
1
0
Fork 0
mirror of https://github.com/truecharts/library-charts.git synced 2026-07-03 18:25:42 -03:00
Code Issues Packages Projects Releases Wiki Activity

automatically add SETUID and SETGID when running as root, also add fl… (#374)

Browse Source 
…ags to disable that

**Description**
<!--
Please include a summary of the change and which issue is fixed. Please
also include relevant motivation and context. List any dependencies that
are required for this change.
-->
⚒️ Fixes  # <!--(issue)-->

**⚙️ Type of change**

- [ ] ⚙️ Feature/App addition
- [ ] 🪛 Bugfix
- [ ] ⚠️ Breaking change (fix or feature that would cause existing
functionality to not work as expected)
- [ ] 🔃 Refactor of current code

**🧪 How Has This Been Tested?**
<!--
Please describe the tests that you ran to verify your changes. Provide
instructions so we can reproduce. Please also list any relevant details
for your test configuration
-->

**📃 Notes:**
<!-- Please enter any other relevant information here -->

**✔️ Checklist:**

- [ ] ⚖️ My code follows the style guidelines of this project
- [ ] 👀 I have performed a self-review of my own code
- [ ] #️⃣ I have commented my code, particularly in hard-to-understand
areas
- [ ] 📄 I have made corresponding changes to the documentation
- [ ] ⚠️ My changes generate no new warnings
- [ ] 🧪 I have added tests to this description that prove my fix is
effective or that my feature works
- [ ] ⬆️ I increased versions for any altered app according to semantic
versioning

**➕ App addition**

If this PR is an app addition please make sure you have done the
following.

- [ ] 🪞 I have opened a PR on
[truecharts/containers](https://github.com/truecharts/containers) adding
the container to TrueCharts mirror repo.
- [ ] 🖼️ I have added an icon in the Chart's root directory called
`icon.png`

---

_Please don't blindly check all the boxes. Read them and only check
those that apply.
Those checkboxes are there for the reviewer to see what is this all
about and
the status of this PR with a quick glance._
This commit is contained in:
Stavros Kois
2023-04-05 10:16:25 +03:00
committed by GitHub
parent ab721c9d08
commit 2d3925348f
4 changed files with 300 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

275
library/common-test/tests/container/securityContext_test.yaml
View File

@@ -92,6 +92,8 @@ tests:
capabilities:
add:
- CHOWN
- SETUID
- SETGID
drop:
- ALL
@@ -496,6 +498,202 @@ tests:
capabilities:
add:
- CHOWN
- SETUID
- SETGID
drop:
- ALL
- it: should not include SETUID/SETGID when disabled from global
set:
image: *image
securityContext:
container:
runAsNonRoot: false
runAsUser: 0
runAsGroup: 0
capabilities:
disableAutoCapSETUID: true
disableAutoCapSETGID: true
workload:
workload-name1:
enabled: true
primary: true
type: Deployment
podSpec:
containers:
container-name1:
enabled: true
primary: true
imageSelector: image
probes: *probes
asserts:
- documentIndex: &deploymentDoc 0
isKind:
of: Deployment
- documentIndex: *deploymentDoc
isAPIVersion:
of: apps/v1
- documentIndex: *deploymentDoc
isSubset:
path: spec.template.spec.containers[0]
content:
securityContext:
runAsUser: 0
runAsGroup: 0
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
privileged: false
runAsNonRoot: false
seccompProfile:
type: RuntimeDefault
capabilities:
add:
- CHOWN
drop:
- ALL
- it: should not include CHOWN when disabled from global
set:
image: *image
securityContext:
container:
runAsNonRoot: false
runAsUser: 0
runAsGroup: 0
capabilities:
disableAutoCapCHOWN: true
workload:
workload-name1:
enabled: true
primary: true
type: Deployment
podSpec:
containers:
container-name1:
enabled: true
primary: true
imageSelector: image
probes: *probes
asserts:
- documentIndex: &deploymentDoc 0
isKind:
of: Deployment
- documentIndex: *deploymentDoc
isAPIVersion:
of: apps/v1
- documentIndex: *deploymentDoc
isSubset:
path: spec.template.spec.containers[0]
content:
securityContext:
runAsUser: 0
runAsGroup: 0
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
privileged: false
runAsNonRoot: false
seccompProfile:
type: RuntimeDefault
capabilities:
add:
- SETUID
- SETGID
drop:
- ALL
- it: should not include SETUID/SETGID when disabled from container level
set:
image: *image
workload:
workload-name1:
enabled: true
primary: true
type: Deployment
podSpec:
containers:
container-name1:
enabled: true
primary: true
imageSelector: image
probes: *probes
securityContext:
runAsNonRoot: false
runAsUser: 0
runAsGroup: 0
capabilities:
disableAutoCapSETUID: true
disableAutoCapSETGID: true
asserts:
- documentIndex: &deploymentDoc 0
isKind:
of: Deployment
- documentIndex: *deploymentDoc
isAPIVersion:
of: apps/v1
- documentIndex: *deploymentDoc
isSubset:
path: spec.template.spec.containers[0]
content:
securityContext:
runAsUser: 0
runAsGroup: 0
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
privileged: false
runAsNonRoot: false
seccompProfile:
type: RuntimeDefault
capabilities:
add:
- CHOWN
drop:
- ALL
- it: should not include CHOWN when disabled from container level
set:
image: *image
workload:
workload-name1:
enabled: true
primary: true
type: Deployment
podSpec:
containers:
container-name1:
enabled: true
primary: true
imageSelector: image
probes: *probes
securityContext:
runAsNonRoot: false
runAsUser: 0
runAsGroup: 0
capabilities:
disableAutoCapCHOWN: true
asserts:
- documentIndex: &deploymentDoc 0
isKind:
of: Deployment
- documentIndex: *deploymentDoc
isAPIVersion:
of: apps/v1
- documentIndex: *deploymentDoc
isSubset:
path: spec.template.spec.containers[0]
content:
securityContext:
runAsUser: 0
runAsGroup: 0
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
privileged: false
runAsNonRoot: false
seccompProfile:
type: RuntimeDefault
capabilities:
add:
- SETUID
- SETGID
drop:
- ALL
@@ -568,6 +766,8 @@ tests:
capabilities:
add:
- CHOWN
- SETUID
- SETGID
drop:
- ALL
@@ -830,3 +1030,78 @@ tests:
asserts:
- failedTemplate:
errorMessage: Container - Expected <securityContext.capabilities.drop> to be [list], but got [string]
- it: should fail capabilities.disableAutoCapCHOWN not a bool
set:
image: *image
workload:
workload-name1:
enabled: true
primary: true
type: Deployment
podSpec:
containers:
container-name1:
enabled: true
primary: true
imageSelector: image
probes: *probes
securityContext:
runAsUser: 0
runAsGroup: 0
runAsNonRoot: false
capabilities:
disableAutoCapCHOWN: not-bool
asserts:
- failedTemplate:
errorMessage: Container - Expected <securityContext.capabilities.disableAutoCapCHOWN> to be [bool], but got [not-bool] of type [string]
- it: should fail capabilities.disableAutoCapSETUID not a bool
set:
image: *image
workload:
workload-name1:
enabled: true
primary: true
type: Deployment
podSpec:
containers:
container-name1:
enabled: true
primary: true
imageSelector: image
probes: *probes
securityContext:
runAsUser: 0
runAsGroup: 0
runAsNonRoot: false
capabilities:
disableAutoCapSETUID: not-bool
asserts:
- failedTemplate:
errorMessage: Container - Expected <securityContext.capabilities.disableAutoCapSETUID> to be [bool], but got [not-bool] of type [string]
- it: should fail capabilities.disableAutoCapSETGID not a bool
set:
image: *image
workload:
workload-name1:
enabled: true
primary: true
type: Deployment
podSpec:
containers:
container-name1:
enabled: true
primary: true
imageSelector: image
probes: *probes
securityContext:
runAsUser: 0
runAsGroup: 0
runAsNonRoot: false
capabilities:
disableAutoCapSETGID: not-bool
asserts:
- failedTemplate:
errorMessage: Container - Expected <securityContext.capabilities.disableAutoCapSETGID> to be [bool], but got [not-bool] of type [string]

2
library/common/Chart.yaml
View File

@@ -15,4 +15,4 @@ maintainers:
name: common
sources: null
type: library
version: 12.2.31
version: 12.2.32

20
library/common/templates/lib/container/_securityContext.tpl
View File

@@ -138,8 +138,26 @@ objectData: The object data to be used to render the container.
Lets add automatically the CHOWN cap.
*/}}
{{- if eq (int $secContext.runAsUser) 0 -}}
{{- range $key := (list "CHOWN" "SETUID" "SETGID") -}}
{{- $value := (get $secContext.capabilities (printf "disableAutoCap%s" $key)) -}}
{{- if not (kindIs "bool" $value) -}}
{{- fail (printf "Container - Expected <securityContext.capabilities.disableAutoCap%s> to be [bool], but got [%s] of type [%s]" $key $value (kindOf $value)) -}}
{{- end -}}
{{- end -}}
{{- $addCap := $secContext.capabilities.add -}}
{{- $addCap = mustAppend $addCap "CHOWN" -}}
{{- if not $secContext.capabilities.disableAutoCapCHOWN -}}
{{- $addCap = mustAppend $addCap "CHOWN" -}}
{{- end -}}
{{- if not $secContext.capabilities.disableAutoCapSETUID }}
{{- $addCap = mustAppend $addCap "SETUID" -}}
{{- end -}}
{{- if not $secContext.capabilities.disableAutoCapSETGID }}
{{- $addCap = mustAppend $addCap "SETGID" -}}
{{- end -}}
{{- $_ := set $secContext.capabilities "add" $addCap -}}
{{- end -}}

5
library/common/values.yaml
View File

@@ -79,6 +79,11 @@ securityContext:
add: []
drop:
- ALL
# When set to false, it will automatically
# add the capability when container runs as ROOT
disableAutoCapCHOWN: false
disableAutoCapSETUID: false
disableAutoCapSETGID: false
# -- PUID for all containers
# Can be overruled per container
PUID: 568