Documentation for Adding Policies

[janz29]

Hi,

I have been looking for some documentation on how to properly add policies to hbm. Is there any available? If this is the wrong place to ask, can you point me in the right direction.

Thank you,

[ghost]

Hi,

There is the website http://harbormaster.io/docs/ which is not complete and not up to date. I'm working on updating it.

To add a policy you need to have 2 elements, a group and a collection. By default, all Docker commands and restricted parameters are allowed. To change that behavior, an option needs to be set to true, then all commands will be blocked and so need to be white-listed.

hbm config set authorization true

First create an user and group. If Docker Daemon is listening on Unix socket, the only user will be root.

hbm group add local
hbm user add root
hbm user member --add local root

Then create a collection to which resources will be assigned to. Resources could be anything from Docker commands to images, volumes, restricted parameters like --privileged; --net=host and so on... A list of types and values can be found on that page.

hbm collection add collection1
hbm resource add --type action --value info info
hbm resource add --type action --value version version
hbm resource member --add collection1 info
hbm resource member --add collection1 version

To finish create the policy.

hbm policy add --group local --collection collection1 policy1

Let me know if you have any questions.

Thanks

[odg0318]

When I read your plugin code, there are much more features to control docker commandline. Could you let me know when you will update the documentation?

Thanks!

[ghost]

sure, i will post a message here when documentation will be updated

[janz29]

Is there anyway for you policy configs to stick even after the service restarts? I have added the policies and set authorization to true, but anytime the hbm service is restarted the machine loses the config value.

[ghost]

how do you start the service?

[janz29]

i just saw the another report and added the service to automatically start with authorization set to true. Is it possible to set up a call at some point? It can be very useful to us!

[odg0318]

@janz29 related to #12 ?

[janz29]

Yes related to #12

[ghost]

I have started to update documentation in the directory docs, not published on the website yet.

Let me know if you have any feedback.

Thanks

[ghost]

@janz29 @odg0318 the docs are updated on the website. Let me know what you think.

Thank you

[janz29]

@juliengk Looks good. i noticed on the get started page the link to the installation page is broken. I would also suggest adding some examples if possible.

[odg0318]

@juliengk I agree with @janz29 suggestion. More examples per each command help developers easily understood. For example, it is hard to use Volume type to add. In my case, I should have read many codes to use it. Anyway much better. Thanks

[ghost]

all right. I will add more examples.

Thank you

[caoruidong]

Hi, so it cannot used in RBAC if TLS is not enabled in docker daemon?

[odg0318]

@caoruidong As I know, no way. Only root is set to an user variable on a handler.

[ghost]

https://docs.docker.com/engine/extend/plugins_authorization/#default-user-authorization-mechanism

[caoruidong]

Thank you guys. I got it.