feat(enforcer): enforce read only policies in bpflsm #971
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
file access events go through file_open then file_permission, we only get to know about the mask in file_permission. This commit implements differentiating between read and write events in file_permission hook, rest of the enforcement is handled in file_open. Signed-off-by: daemon1024 <barun.acharya@accuknox.com>
nyrahul
approved these changes
Nov 9, 2022
There was a problem hiding this comment.
Code LGTM. But it is difficult to do a thorough review of this PR. Currently we also do not have a way to automate BPF-LSM system tests.
I am ok to merge this PR based on manual tests. Yesterday I reached out to CNCF for more powerful GH Actions Runners and they will soon get back to us.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Purpose of PR?:
File access events go through file_open then file_permission, we only get to know about the mask in file_permission. This commit implements differentiating between read and write events in file_permission hook, rest of the enforcement is handled in file_open.
Ref #795
If the changes in this PR are manually verified, list down the scenarios covered::
Applied a read-only policy and verified behaviour.
Checklist:
<type>(<scope>): <subject>TODO: