Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add DAC_READ_SEARCH for CIDR cert expiry tests #86

Merged
merged 2 commits into from Oct 11, 2023
Merged

Add DAC_READ_SEARCH for CIDR cert expiry tests #86

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2a0b564
Add DAC_READ_SEARCH for CIDR cert expiry attacks
rowezuniga Oct 11, 2023
4992ee3
Update gremlin/values.yaml
rowezuniga Oct 11, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
2 changes: 1 addition & 1 deletion gremlin/Chart.yaml
View file
Open in desktop
@@ -1,5 +1,5 @@
name: gremlin
version: 0.10.0
version: 0.11.0
description: The Gremlin Inc client application
apiVersion: v1
home: https://www.gremlin.com
Expand Down
39 changes: 20 additions & 19 deletions gremlin/values.yaml
View file
Open in desktop
Expand Up @@ -126,32 +126,33 @@ gremlin:
# Daemonset as well as any pod security resource that governs it. Capabilities that are required for specific
# attacks can be removed from this list if running such attacks are not desired.
capabilities:
- KILL # Required to run Process Killer attacks
- NET_ADMIN # Required to run network attacks
- SYS_BOOT # Required to run Shutdown attacks
- SYS_TIME # Required to run Time Travel attacks
- KILL # Required to run Process Killer attacks
- NET_ADMIN # Required to run network attacks
- SYS_BOOT # Required to run Shutdown attacks
- SYS_TIME # Required to run Time Travel attacks
- DAC_READ_SEARCH # Required to run Certificate Expiry attacks
rowezuniga marked this conversation as resolved.
Show resolved Hide resolved

- SYS_ADMIN # Required by container drivers: docker-runc, crio-runc, containerd-runc
# to run attacks against running containers
- SYS_ADMIN # Required by container drivers: docker-runc, crio-runc, containerd-runc
# to run attacks against running containers

- SYS_PTRACE # Required by container drivers: docker-runc, crio-runc, containerd-runc
# to determine if Gremlin is in the host's pid namespace
- SYS_PTRACE # Required by container drivers: docker-runc, crio-runc, containerd-runc
# to determine if Gremlin is in the host's pid namespace

- SETFCAP # Required by container drivers: docker-runc, crio-runc, containerd-runc
# to set capabilities on Gremlin attack sidecars
- SETFCAP # Required by container drivers: docker-runc, crio-runc, containerd-runc
# to set capabilities on Gremlin attack sidecars

- AUDIT_WRITE # Required by container drivers: docker-runc, crio-runc, containerd-runc
# to write to the Kernel's audit log
- AUDIT_WRITE # Required by container drivers: docker-runc, crio-runc, containerd-runc
# to write to the Kernel's audit log

- MKNOD # Required by container drivers: docker-runc, crio-runc, containerd-runc
# to create new devices for Gremlin attack sidecars
- MKNOD # Required by container drivers: docker-runc, crio-runc, containerd-runc
# to create new devices for Gremlin attack sidecars

- SYS_CHROOT # Required by container drivers: docker-runc, crio-runc, containerd-runc
# to create and enter new namespaces for Gremlin attack sidecars
- SYS_CHROOT # Required by container drivers: docker-runc, crio-runc, containerd-runc
# to create and enter new namespaces for Gremlin attack sidecars

- NET_RAW # Required by container drivers: docker-runc, crio-runc, containerd-runc
# Not actively used by Gremlin but requested by sidecars
# This capability will be removed in a later release
- NET_RAW # Required by container drivers: docker-runc, crio-runc, containerd-runc
# Not actively used by Gremlin but requested by sidecars
# This capability will be removed in a later release

# gremlin.podSecurity.seLinuxOptions -
# Specifies SELinux options to apply to the Gremlin Daemonset container securityContext.
Expand Down