KubeArmor icon indicating copy to clipboard operation
KubeArmor copied to clipboard

Fixes bug #1787 non-k8s: KubeArmor panics when not-enabled policy type is received

Open itsCheithanya opened this issue 8 months ago • 0 comments

This fixes the bug that KubeArmor panics when not-enabled policy type is being received Reproduce the issue : Modify make run target in KubeArmor's Makefile to something like below such that host policy is disabled:

 cd $(CURDIR); DEBUG=true sudo -E ./kubearmor -k8s=false -logPath=/tmp/kubearmor.log -enableKubeArmorPolicy -defaultFilePosture block -defaultCapabilitiesPosture block -defaultNetworkPosture block 

Once KubeArmor is running, send the below host policy by running karmor vm policy --gRPC=:32767 add <path-to-policy> :


apiVersion: security.kubearmor.com/v1
kind: KubeArmorHostPolicy
metadata:
  name: hsp-block-sleep
spec:
  severity: 10
  message: "sleep was attempted to be executed"
  tags:
  - ALERT
  nodeSelector:
    matchLabels:
      kubearmor.io/hostname: '*'
  process:
    matchPaths:
    - path: /usr/bin/sleep
  action:
    Block

image You'll see that KubeArmor doesn't panic : image

Fixes #1787

If the changes in this PR are manually verified, list down the scenarios covered::

Additional information for reviewer? : Mention if this PR is part of any design or a continuation of previous PRs

Checklist:

  • [ ] Bug fix. Fixes #1787
  • [ ] New feature (non-breaking change which adds functionality)
  • [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • [ ] This change requires a documentation update
  • [ ] PR Title follows the convention of <type>(<scope>): <subject>
  • [ ] Commit has unit tests
  • [ ] Commit has integration tests

itsCheithanya avatar Jun 24 '24 15:06 itsCheithanya