KubeArmor
KubeArmor copied to clipboard
Fixes bug #1787 non-k8s: KubeArmor panics when not-enabled policy type is received
This fixes the bug that KubeArmor panics when not-enabled policy type is being received Reproduce the issue : Modify make run target in KubeArmor's Makefile to something like below such that host policy is disabled:
cd $(CURDIR); DEBUG=true sudo -E ./kubearmor -k8s=false -logPath=/tmp/kubearmor.log -enableKubeArmorPolicy -defaultFilePosture block -defaultCapabilitiesPosture block -defaultNetworkPosture block
Once KubeArmor is running, send the below host policy by running karmor vm policy --gRPC=:32767 add <path-to-policy>
:
apiVersion: security.kubearmor.com/v1
kind: KubeArmorHostPolicy
metadata:
name: hsp-block-sleep
spec:
severity: 10
message: "sleep was attempted to be executed"
tags:
- ALERT
nodeSelector:
matchLabels:
kubearmor.io/hostname: '*'
process:
matchPaths:
- path: /usr/bin/sleep
action:
Block
You'll see that KubeArmor doesn't panic :
Fixes #1787
If the changes in this PR are manually verified, list down the scenarios covered::
Additional information for reviewer? : Mention if this PR is part of any design or a continuation of previous PRs
Checklist:
- [ ] Bug fix. Fixes #1787
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
- [ ] This change requires a documentation update
- [ ] PR Title follows the convention of
<type>(<scope>): <subject>
- [ ] Commit has unit tests
- [ ] Commit has integration tests