From 5dc4da7c6a97b1dd0b1eededf5b0aec21c5161e9 Mon Sep 17 00:00:00 2001 From: Jordan Liggitt Date: Fri, 6 Oct 2017 16:29:57 -0400 Subject: [PATCH] PodSecurityPolicy: limit validation to provided groups --- .../podsecuritypolicy/group/mustrunas.go | 11 +++-------- .../podsecuritypolicy/group/mustrunas_test.go | 17 +---------------- .../podsecuritypolicy/group/runasany.go | 6 +++--- 3 files changed, 7 insertions(+), 27 deletions(-) diff --git a/pkg/security/podsecuritypolicy/group/mustrunas.go b/pkg/security/podsecuritypolicy/group/mustrunas.go index 6413ed2d4d..b2182afaa3 100644 --- a/pkg/security/podsecuritypolicy/group/mustrunas.go +++ b/pkg/security/podsecuritypolicy/group/mustrunas.go @@ -46,13 +46,13 @@ func NewMustRunAs(ranges []extensions.GroupIDRange, field string) (GroupStrategy // Generate creates the group based on policy rules. By default this returns the first group of the // first range (min val). -func (s *mustRunAs) Generate(pod *api.Pod) ([]int64, error) { +func (s *mustRunAs) Generate(_ *api.Pod) ([]int64, error) { return []int64{s.ranges[0].Min}, nil } // Generate a single value to be applied. This is used for FSGroup. This strategy will return // the first group of the first range (min val). -func (s *mustRunAs) GenerateSingle(pod *api.Pod) (*int64, error) { +func (s *mustRunAs) GenerateSingle(_ *api.Pod) (*int64, error) { single := new(int64) *single = s.ranges[0].Min return single, nil @@ -61,14 +61,9 @@ func (s *mustRunAs) GenerateSingle(pod *api.Pod) (*int64, error) { // Validate ensures that the specified values fall within the range of the strategy. // Groups are passed in here to allow this strategy to support multiple group fields (fsgroup and // supplemental groups). -func (s *mustRunAs) Validate(pod *api.Pod, groups []int64) field.ErrorList { +func (s *mustRunAs) Validate(_ *api.Pod, groups []int64) field.ErrorList { allErrs := field.ErrorList{} - if pod.Spec.SecurityContext == nil { - allErrs = append(allErrs, field.Invalid(field.NewPath("securityContext"), pod.Spec.SecurityContext, "unable to validate nil security context")) - return allErrs - } - if len(groups) == 0 && len(s.ranges) > 0 { allErrs = append(allErrs, field.Invalid(field.NewPath(s.field), groups, "unable to validate empty groups against required ranges")) } diff --git a/pkg/security/podsecuritypolicy/group/mustrunas_test.go b/pkg/security/podsecuritypolicy/group/mustrunas_test.go index 554e8a19a2..d3075a8862 100644 --- a/pkg/security/podsecuritypolicy/group/mustrunas_test.go +++ b/pkg/security/podsecuritypolicy/group/mustrunas_test.go @@ -109,14 +109,6 @@ func TestGenerate(t *testing.T) { } func TestValidate(t *testing.T) { - validPod := func() *api.Pod { - return &api.Pod{ - Spec: api.PodSpec{ - SecurityContext: &api.PodSecurityContext{}, - }, - } - } - tests := map[string]struct { ranges []extensions.GroupIDRange pod *api.Pod @@ -124,19 +116,16 @@ func TestValidate(t *testing.T) { pass bool }{ "nil security context": { - pod: &api.Pod{}, ranges: []extensions.GroupIDRange{ {Min: 1, Max: 3}, }, }, "empty groups": { - pod: validPod(), ranges: []extensions.GroupIDRange{ {Min: 1, Max: 3}, }, }, "not in range": { - pod: validPod(), groups: []int64{5}, ranges: []extensions.GroupIDRange{ {Min: 1, Max: 3}, @@ -144,7 +133,6 @@ func TestValidate(t *testing.T) { }, }, "in range 1": { - pod: validPod(), groups: []int64{2}, ranges: []extensions.GroupIDRange{ {Min: 1, Max: 3}, @@ -152,7 +140,6 @@ func TestValidate(t *testing.T) { pass: true, }, "in range boundry min": { - pod: validPod(), groups: []int64{1}, ranges: []extensions.GroupIDRange{ {Min: 1, Max: 3}, @@ -160,7 +147,6 @@ func TestValidate(t *testing.T) { pass: true, }, "in range boundry max": { - pod: validPod(), groups: []int64{3}, ranges: []extensions.GroupIDRange{ {Min: 1, Max: 3}, @@ -168,7 +154,6 @@ func TestValidate(t *testing.T) { pass: true, }, "singular range": { - pod: validPod(), groups: []int64{4}, ranges: []extensions.GroupIDRange{ {Min: 4, Max: 4}, @@ -182,7 +167,7 @@ func TestValidate(t *testing.T) { if err != nil { t.Errorf("error creating strategy for %s: %v", k, err) } - errs := s.Validate(v.pod, v.groups) + errs := s.Validate(nil, v.groups) if v.pass && len(errs) > 0 { t.Errorf("unexpected errors for %s: %v", k, errs) } diff --git a/pkg/security/podsecuritypolicy/group/runasany.go b/pkg/security/podsecuritypolicy/group/runasany.go index aff046d50b..071f2e08ec 100644 --- a/pkg/security/podsecuritypolicy/group/runasany.go +++ b/pkg/security/podsecuritypolicy/group/runasany.go @@ -33,17 +33,17 @@ func NewRunAsAny() (GroupStrategy, error) { } // Generate creates the group based on policy rules. This strategy returns an empty slice. -func (s *runAsAny) Generate(pod *api.Pod) ([]int64, error) { +func (s *runAsAny) Generate(_ *api.Pod) ([]int64, error) { return nil, nil } // Generate a single value to be applied. This is used for FSGroup. This strategy returns nil. -func (s *runAsAny) GenerateSingle(pod *api.Pod) (*int64, error) { +func (s *runAsAny) GenerateSingle(_ *api.Pod) (*int64, error) { return nil, nil } // Validate ensures that the specified values fall within the range of the strategy. -func (s *runAsAny) Validate(pod *api.Pod, groups []int64) field.ErrorList { +func (s *runAsAny) Validate(_ *api.Pod, groups []int64) field.ErrorList { return field.ErrorList{} }