PodSecurityPolicy should respect and validate user-supplied RunAsNonR… #47073

Q-Lee · 2017-06-06T19:31:25Z

What this PR does / why we need it: PodSecurityPolicies overwrite and then fail to validate the RunAsNonRoot field in the container security context.

Which issue this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close that issue when PR gets merged): fixes #47071

Special notes for your reviewer: gce/gke don't use this in 1.6. You'll need to speak up if you think this is important enough to patch. It should almost certainly go into 1.7.

Release note:

PodSecurityPolicy now recognizes pods that specify `runAsNonRoot: false` in their security context and does not overwrite the specified value

liggitt · 2017-06-06T19:32:55Z

@kubernetes/sig-auth-pr-reviews

liggitt · 2017-06-06T19:32:59Z

cc @pweil-

liggitt · 2017-06-06T19:34:26Z

pkg/security/podsecuritypolicy/user/nonroot.go

@@ -51,8 +51,13 @@ func (s *nonRoot) Validate(pod *api.Pod, container *api.Container) field.ErrorLi
 		allErrs = append(allErrs, field.Invalid(securityContextPath, container.SecurityContext, detail))
 		return allErrs
 	}
+	if container.SecurityContext.RunAsNonRoot != nil && *container.SecurityContext.RunAsNonRoot == false {
+		detail := fmt.Sprintf("RunAsNonRoot is forbidden by the pod security policy for container %s", container.Name)


RunAsNonRoot=false is forbidden... you could set it to true if you wanted

update godoc

Ok, that message is backwards. Let me fix it for you :D

liggitt · 2017-06-06T19:37:54Z

pkg/security/podsecuritypolicy/provider.go

@@ -165,7 +165,10 @@ func (s *simpleProvider) CreateContainerSecurityContext(pod *api.Pod, container
 	// if we're using the non-root strategy set the marker that this container should not be
 	// run as root which will signal to the kubelet to do a final check either on the runAsUser
 	// or, if runAsUser is not set, the image UID will be checked.
-	if s.psp.Spec.RunAsUser.Rule == extensions.RunAsUserStrategyMustRunAsNonRoot {
+	if sc.RunAsNonRoot != nil {


we only need to do something if sc.RunAsNonRoot == nil... the change in nonRoot#Validate() ensures a non-nil value is acceptable, so we don't need to overwrite it here (and the impl in this block is a no-op, anyway)

Ya, that's better.

liggitt · 2017-06-06T19:38:50Z

I'd like to see unit tests around both the Validate() and CreateContainerSecurityContext() changes

pweil-

+1 to this. IIRC the original behavior was a hold over from the time when the SCDeny plugin was used to prevent people from setting items in the SC so the system could always just DTRT.

Please make sure to add the scenario to the provider tests that do the pass/fail testing for the strategies.

Q-Lee · 2017-06-06T21:35:55Z

@liggitt @pweil- I've added unit tests.

@spxtr unit test changes trigger full e2e changes. Is that necessary?

liggitt · 2017-06-07T02:14:08Z

pkg/security/podsecuritypolicy/provider_test.go

 	createPod := func() *api.Pod {
 		return &api.Pod{
 			Spec: api.PodSpec{
 				Containers: []api.Container{{
-					SecurityContext: &api.SecurityContext{},
+					SecurityContext: &api.SecurityContext{RunAsNonRoot: &untrue},


the point of this test is to make sure CreateContainerSecurityContext doesn't mutate a pod, so I'd want to leave it completely empty (no RunAsNonRoot set) to enable as many of the if ... == nil { ... } blocks as possible to run

liggitt · 2017-06-07T02:19:03Z

pkg/security/podsecuritypolicy/user/nonroot_test.go

+		{
+			container: &api.Container{
+				SecurityContext: &api.SecurityContext{
+					RunAsNonRoot: &untrue,


and test that one with RunAsNonRoot: &true returns no error

…oot fields.

Q-Lee · 2017-06-12T02:12:15Z

@k8s-bot pull-kubernetes-e2e-gce-etcd3 test this

spxtr · 2017-06-12T16:56:37Z

@spxtr unit test changes trigger full e2e changes. Is that necessary?

Currently every change triggers full e2e. This is something we can fix with the magic of bazel!

liggitt · 2017-06-12T17:55:57Z

/lgtm

Q-Lee · 2017-06-12T22:08:38Z

/assign @brendandburns

@liggitt - the psp owners file is pretty sparse.

brendandburns · 2017-06-13T04:03:55Z

/approve

k8s-github-robot · 2017-06-13T04:05:29Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Q-Lee, brendandburns, liggitt

Associated issue: 47071

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these OWNERS Files:

~~pkg/OWNERS~~ [brendandburns]

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

k8s-github-robot · 2017-06-14T07:43:48Z

@k8s-bot test this [submit-queue is verifying that this PR is safe to merge]

k8s-ci-robot · 2017-06-14T08:48:14Z

@Q-Lee: The following test failed, say /retest to rerun them all:

Test name	Commit	Details	Rerun command
pull-kubernetes-e2e-gce-etcd3	`158f17b`	link	`@k8s-bot pull-kubernetes-e2e-gce-etcd3 test this`

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

k8s-github-robot · 2017-06-14T08:52:12Z

Automatic merge from submit-queue (batch tested with PRs 47073, 47457, 47479)

Q-Lee requested a review from liggitt June 6, 2017 19:31

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Jun 6, 2017

k8s-ci-robot added the sig/auth Categorizes an issue or PR as relevant to SIG Auth. label Jun 6, 2017

liggitt self-assigned this Jun 6, 2017

Q-Lee requested a review from pweil- June 6, 2017 19:33

liggitt reviewed Jun 6, 2017

View reviewed changes

k8s-github-robot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. release-note Denotes a PR that will be considered when it comes time to generate release notes. labels Jun 6, 2017

pweil- reviewed Jun 6, 2017

View reviewed changes

k8s-github-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Jun 6, 2017

liggitt reviewed Jun 7, 2017

View reviewed changes

liggitt added the kind/bug Categorizes issue or PR as related to a bug. label Jun 7, 2017

liggitt added this to the v1.8 milestone Jun 8, 2017

PodSecurityPolicy should respect and validate user-supplied RunAsNonR…

158f17b

…oot fields.

Q-Lee force-pushed the psp-run-as-non-root branch from e2b2a34 to 158f17b Compare June 9, 2017 18:47

k8s-github-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Jun 9, 2017

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jun 12, 2017

k8s-ci-robot assigned brendandburns Jun 12, 2017

k8s-github-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 13, 2017

Q-Lee modified the milestones: v1.7, v1.8 Jun 14, 2017

k8s-github-robot merged commit 60c1c1e into kubernetes:master Jun 14, 2017

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

PodSecurityPolicy should respect and validate user-supplied RunAsNonR… #47073

PodSecurityPolicy should respect and validate user-supplied RunAsNonR… #47073

Q-Lee commented Jun 6, 2017 •

edited by liggitt

Loading

liggitt commented Jun 6, 2017

liggitt commented Jun 6, 2017

liggitt Jun 6, 2017

liggitt Jun 6, 2017

Q-Lee Jun 6, 2017

liggitt Jun 6, 2017

Q-Lee Jun 6, 2017

liggitt commented Jun 6, 2017

pweil- left a comment

Q-Lee commented Jun 6, 2017

liggitt Jun 7, 2017

Q-Lee Jun 9, 2017

liggitt Jun 7, 2017

Q-Lee Jun 9, 2017

Q-Lee commented Jun 12, 2017

spxtr commented Jun 12, 2017

liggitt commented Jun 12, 2017

Q-Lee commented Jun 12, 2017

brendandburns commented Jun 13, 2017

k8s-github-robot commented Jun 13, 2017

k8s-github-robot commented Jun 14, 2017

k8s-ci-robot commented Jun 14, 2017

k8s-github-robot commented Jun 14, 2017

PodSecurityPolicy should respect and validate user-supplied RunAsNonR… #47073

PodSecurityPolicy should respect and validate user-supplied RunAsNonR… #47073

Conversation

Q-Lee commented Jun 6, 2017 • edited by liggitt Loading

liggitt commented Jun 6, 2017

liggitt commented Jun 6, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

liggitt commented Jun 6, 2017

pweil- left a comment

Choose a reason for hiding this comment

Q-Lee commented Jun 6, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Q-Lee commented Jun 12, 2017

spxtr commented Jun 12, 2017

liggitt commented Jun 12, 2017

Q-Lee commented Jun 12, 2017

brendandburns commented Jun 13, 2017

k8s-github-robot commented Jun 13, 2017

k8s-github-robot commented Jun 14, 2017

k8s-ci-robot commented Jun 14, 2017

k8s-github-robot commented Jun 14, 2017

Q-Lee commented Jun 6, 2017 •

edited by liggitt

Loading