github
/
k3s
mirror of https://github.com/k3s-io/k3s
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

PodSecurityPolicy: Do not mutate nil privileged field to false

pull/6/head
Jordan Liggitt 2017-10-05 15:55:53 -04:00
parent 77b83e446b
commit b45b809f4c
No known key found for this signature in database
GPG Key ID: 39928704103C7229
2 changed files with 31 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
pkg/security/podsecuritypolicy/provider.go
View File

@ -157,11 +157,6 @@ func (s *simpleProvider) CreateContainerSecurityContext(pod *api.Pod, container
return nil, nil, err
}
if sc.Privileged == nil {
priv := false
sc.Privileged = &priv
}
// if we're using the non-root strategy set the marker that this container should not be
// run as root which will signal to the kubelet to do a final check either on the runAsUser
// or, if runAsUser is not set, the image UID will be checked.
@ -284,7 +279,7 @@ func (s *simpleProvider) ValidateContainerSecurityContext(pod *api.Pod, containe
allErrs = append(allErrs, s.strategies.AppArmorStrategy.Validate(pod, container)...)
allErrs = append(allErrs, s.strategies.SeccompStrategy.ValidateContainer(pod, container)...)
if !s.psp.Spec.Privileged && *sc.Privileged {
if !s.psp.Spec.Privileged && sc.Privileged != nil && *sc.Privileged {
allErrs = append(allErrs, field.Invalid(fldPath.Child("privileged"), *sc.Privileged, "Privileged containers are not allowed"))
}

41
plugin/pkg/admission/security/podsecuritypolicy/admission_test.go
View File

@ -204,37 +204,54 @@ func TestAdmitPrivileged(t *testing.T) {
privilegedPSP.Name = "priv"
privilegedPSP.Spec.Privileged = true
trueValue := true
falseValue := false
tests := map[string]struct {
pod *kapi.Pod
psps []*extensions.PodSecurityPolicy
shouldPass bool
expectedPriv bool
expectedPriv *bool
expectedPSP string
}{
"pod without priv request allowed under non priv PSP": {
"pod with priv=nil allowed under non priv PSP": {
pod: goodPod(),
psps: []*extensions.PodSecurityPolicy{nonPrivilegedPSP},
shouldPass: true,
expectedPriv: false,
expectedPriv: nil,
expectedPSP: nonPrivilegedPSP.Name,
},
"pod without priv request allowed under priv PSP": {
"pod with priv=nil allowed under priv PSP": {
pod: goodPod(),
psps: []*extensions.PodSecurityPolicy{privilegedPSP},
shouldPass: true,
expectedPriv: false,
expectedPriv: nil,
expectedPSP: privilegedPSP.Name,
},
"pod with priv request denied by non priv PSP": {
"pod with priv=false allowed under non priv PSP": {
pod: createPodWithPriv(false),
psps: []*extensions.PodSecurityPolicy{nonPrivilegedPSP},
shouldPass: true,
expectedPriv: &falseValue,
expectedPSP: nonPrivilegedPSP.Name,
},
"pod with priv=false allowed under priv PSP": {
pod: createPodWithPriv(false),
psps: []*extensions.PodSecurityPolicy{privilegedPSP},
shouldPass: true,
expectedPriv: &falseValue,
expectedPSP: privilegedPSP.Name,
},
"pod with priv=true denied by non priv PSP": {
pod: createPodWithPriv(true),
psps: []*extensions.PodSecurityPolicy{nonPrivilegedPSP},
shouldPass: false,
},
"pod with priv request allowed by priv PSP": {
"pod with priv=true allowed by priv PSP": {
pod: createPodWithPriv(true),
psps: []*extensions.PodSecurityPolicy{nonPrivilegedPSP, privilegedPSP},
shouldPass: true,
expectedPriv: true,
expectedPriv: &trueValue,
expectedPSP: privilegedPSP.Name,
},
}
@ -243,9 +260,11 @@ func TestAdmitPrivileged(t *testing.T) {
testPSPAdmit(k, v.psps, v.pod, v.shouldPass, v.expectedPSP, t)
if v.shouldPass {
if v.pod.Spec.Containers[0].SecurityContext.Privileged == nil ||
*v.pod.Spec.Containers[0].SecurityContext.Privileged != v.expectedPriv {
t.Errorf("%s expected privileged to be %t", k, v.expectedPriv)
priv := v.pod.Spec.Containers[0].SecurityContext.Privileged
if (priv == nil) != (v.expectedPriv == nil) {
t.Errorf("%s expected privileged to be %v, got %v", k, v.expectedPriv, priv)
} else if priv != nil && *priv != *v.expectedPriv {
t.Errorf("%s expected privileged to be %v, got %v", k, *v.expectedPriv, *priv)
}
}
}