WIP: resolve symlinked host binds

[flixr]

Resolve symlinked host binds and provide them in HostBinds, so we can properly check the paths. Should solve #34

[flixr]

@anderseknert so this doesn't seem to work, BindMounts is always null even if Body.HostConfig.Binds has a bind mount (starting with /). Not sure what is still wrong/missing... I probably don't have much time to spend on this right now anymore. So if you want to take this over and do it properly, it would be very much appreciated! I could probably find time to briefly test stuff...

[flixr]

So at least the resolving seems to work now, but I'm not sure how to write a policy file that correctly denies any request that has bind mounts except for a paths starting with certain prefix.

[flixr]

So this works with a policy like (excerpt):

package docker.authz

default allow = false

allow {
    not restricted_host_bind
    not privileged
}

# bind mounts to host with these prefixes are allowed
allowed_host_path_prefixes := {"/allowed/path/prefix/"}

restricted_host_bind
{
    allowed_host_binds := {x | x:= input.BindMounts[_]; startswith(x, allowed_host_path_prefixes[_])}
    count(input.BindMounts) != count(allowed_host_binds)
}

privileged {
    input.Body.HostConfig.Privileged == true
}

I think we should still parse the Mounts Source of Type bind from docker the same way and also add them to the BindMounts.

[flixr]

I would be happy if you want to take over

[bviktor]

Don't hate me, but :D just one more idea: it'd be really awesome if this resolver could also resolve envvars, like $HOME. Whatcha think?

[flixr]

I would leave that out (at least of this PR)... because whose $HOME? Of the user running opa-docker-authz? But then you would already know the user anyway...

[bviktor]

Nah, the user running the Docker container :-) But yeah, that's prolly another PR for another day.

[flixr]

@anderseknert I updated it a bit for my use-case so I can allow only ReadOnly bind mounts where the source already exists (so that docker doesn't create dirs that don't exist):

• BindMounts: all requested bind mounts
• BindMountsResolved: resolved bind mounts (so must exist on the host) to avoid circumvention by symlink.
• BindMountsResolvedRO: additonally only contains ReadOnly mounts.

and then update the policy from above with

restricted_host_bind
{
    allowed_host_binds := {x | x:= input.BindMountsResolvedRO[_]; startswith(x, allowed_host_path_prefixes[_])}
    count(input.BindMounts) != count(allowed_host_binds)
}

[anderseknert]

Looks sensible to me @flixr ... we'd still need some tests to cover this. I've been pretty swamped recently but starting to look better from next week if you want me to help out with that.

[flixr]

@anderseknert did you have a chance to continue here yet?

[anderseknert]

I haven't @flixr ... feel free to pick it up! I don't think I'll be able to in the near future.

[flixr]

For now this does all I need right now and is running fine in production. Also don't have time to spend on making this more complete atm...

[anderseknert]

Resolved with https://github.com/open-policy-agent/opa-docker-authz/pull/65