Skip to content

Commit 7dc2981

Browse files
chen-keinanchen-keinan
committed
fix: handle psp depreciation msg
1 parent ac7da60 commit 7dc2981

File tree

5 files changed

+36
-31
lines changed

5 files changed

+36
-31
lines changed

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ require (
2828
go.uber.org/zap v1.17.0
2929
golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e // indirect
3030
golang.org/x/lint v0.0.0-20210508222113-6edffad5e616 // indirect
31-
golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c // indirect
31+
golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e // indirect
3232
golang.org/x/term v0.0.0-20210615171337-6886f2dfbf5b // indirect
3333
golang.org/x/tools v0.1.2 // indirect
3434
gopkg.in/yaml.v2 v2.4.0

‎go.sum‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -574,6 +574,8 @@ golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBc
574574
golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
575575
golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c h1:F1jZWGFhYfh0Ci55sIpILtKKK8p3i2/krTr0H1rg74I=
576576
golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
577+
golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e h1:WUoyKPm6nCo1BnNUvPGnFG3T5DUVem42yDJZZ4CNxMA=
578+
golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
577579
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
578580
golang.org/x/term v0.0.0-20201210144234-2321bbc49cbf/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
579581
golang.org/x/term v0.0.0-20210615171337-6886f2dfbf5b h1:9zKuko04nR4gjZ4+DNjHqRlAJqbJETHwiNKDqTfOjfE=

‎internal/benchmark/gke/v1.1.0/4.0_policies.yml‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@ categories:
1212
environment and should be used only where and when needed.
1313
profile_applicability: Master
1414
audit:
15-
- tf=/dev/stdout && kubectl get clusterrolebindings -o=custom-columns=NAME:.metadata.name,ROLE:.roleRef.name,SUBJECT:.subjects[*].name
16-
|grep cluster-admin > tf && awk '{ print $3 }' tf
15+
- kubectl get clusterrolebindings -o=custom-columns=NAME:.metadata.name,ROLE:.roleRef.name,SUBJECT:.subjects[*].name
16+
|grep cluster-admin | awk '{ print $3 }'
1717
remediation: |-
1818
Identify all clusterrolebindings to the cluster-admin role. Check if they are used and if they need this role or if they could use a role with fewer privileges.
1919
Where possible, first bind users to a lower privileged role and then remove the clusterrolebinding to the cluster-admin role :
@@ -36,8 +36,8 @@ categories:
3636
of users to reduce the risk of privilege escalation.
3737
profile_applicability: Master
3838
audit:
39-
- tf=/dev/stdout && kubectl get clusterrolebindings -o=custom-columns=NAME:.metadata.name,ROLE:.roleRef.name,SUBJECT:.subjects[*].kind
40-
|grep User > tf && awk '{ print $1 }' tf
39+
- kubectl get clusterrolebindings -o=custom-columns=NAME:.metadata.name,ROLE:.roleRef.name,SUBJECT:.subjects[*].kind
40+
|grep User | awk '{ print $1 }'
4141
- 'kubectl auth can-i get secrets --all-namespaces --as #0'
4242
- kubectl auth can-i list secrets --all-namespaces --as=#0
4343
- kubectl auth can-i watch secrets --all-namespaces --as=#0
@@ -77,8 +77,8 @@ categories:
7777
As such, access to create new pods should be restricted to the smallest possible group of users.
7878
profile_applicability: Master
7979
audit:
80-
- tf=/dev/stdout && kubectl get clusterrolebindings -o=custom-columns=NAME:.metadata.name,ROLE:.roleRef.name,SUBJECT:.subjects[*].kind
81-
|grep User > tf && awk '{ print $1 }' tf
80+
- kubectl get clusterrolebindings -o=custom-columns=NAME:.metadata.name,ROLE:.roleRef.name,SUBJECT:.subjects[*].kind
81+
|grep User | awk '{ print $1 }'
8282
- 'kubectl auth can-i --all-namespaces --as #0 create pod'
8383
remediation: Where possible, remove create access to pod objects in the cluster.
8484
check_type: multi_param
@@ -141,7 +141,7 @@ categories:
141141
flag set to true.
142142
profile_applicability: Master
143143
audit:
144-
- kubectl get psp -o=custom-columns=:.metadata.name
144+
- kubectl get psp 2> /dev/null -o=custom-columns=:.metadata.name
145145
- 'kubectl get psp #0 -o=jsonpath=''{.spec.privileged}'''
146146
remediation: Create a PSP as described in the Kubernetes documentation, ensuring
147147
that the .spec.privileged field is omitted or set to false.
@@ -160,7 +160,7 @@ categories:
160160
set to true.
161161
profile_applicability: Master
162162
audit:
163-
- kubectl get psp -o=custom-columns=:.metadata.name
163+
- kubectl get psp 2> /dev/null -o=custom-columns=:.metadata.name
164164
- 'kubectl get psp #0 -o=jsonpath=''{.spec.hostPID}'''
165165
remediation: Create a PSP as described in the Kubernetes documentation, ensuring
166166
that the .spec.hostPID field is omitted or set to false.
@@ -178,7 +178,7 @@ categories:
178178
set to true.
179179
profile_applicability: Master
180180
audit:
181-
- kubectl get psp -o=custom-columns=:.metadata.name
181+
- kubectl get psp 2> /dev/null -o=custom-columns=:.metadata.name
182182
- 'kubectl get psp #0 -o=jsonpath=''{.spec.hostIPC}'''
183183
remediation: Create a PSP as described in the Kubernetes documentation, ensuring
184184
that the .spec.hostIPC field is omitted or set to false.
@@ -196,7 +196,7 @@ categories:
196196
flag set to true.
197197
profile_applicability: Level 1 - Master Node
198198
audit:
199-
- kubectl get psp -o=custom-columns=:.metadata.name
199+
- kubectl get psp 2> /dev/null -o=custom-columns=:.metadata.name
200200
- 'kubectl get psp #0 -o=jsonpath=''{.spec.hostNetwork}'''
201201
remediation: Create a PSP as described in the Kubernetes documentation, ensuring
202202
that the .spec.hostNetwork field is omitted or set to false.
@@ -214,7 +214,7 @@ categories:
214214
flag set to true.
215215
profile_applicability: Level 1 - Master Node
216216
audit:
217-
- kubectl get psp -o=custom-columns=:.metadata.name
217+
- kubectl get psp 2> /dev/null -o=custom-columns=:.metadata.name
218218
- 'kubectl get psp #0 -o=jsonpath=''{.spec.allowPrivilegeEscalation}'''
219219
remediation: Create a PSP as described in the Kubernetes documentation, ensuring
220220
that the .spec.allowPrivilegeEscalation field is omitted or set to false.
@@ -230,7 +230,7 @@ categories:
230230
description: Do not generally permit containers to be run as the root user.
231231
profile_applicability: Level 1 - Master Node
232232
audit:
233-
- kubectl get psp -o=custom-columns=:.metadata.name
233+
- kubectl get psp 2> /dev/null -o=custom-columns=:.metadata.name
234234
- 'kubectl get psp #0 -o=jsonpath=''{.spec.runAsUser.rule}'''
235235
remediation: Create a PSP as described in the Kubernetes documentation, ensuring that the .spec.runAsUser.rule is set to either MustRunAsNonRoot or MustRunAs with the range of UIDs not including 0.
236236
check_type: multi_param
@@ -244,7 +244,7 @@ categories:
244244
description: Do not generally permit containers with the potentially dangerous NET_RAW capability.
245245
profile_applicability: Level 1 - Master Node
246246
audit:
247-
- 'tfr=/dev/stdout && kubectl get psp -o=custom-columns=:.metadata.name > tfr && sed '':a;N;$!ba;s/\n/ /g'' tfr'
247+
- 'tfr=/dev/stdout && kubectl get psp 2> /dev/null -o=custom-columns=:.metadata.name > tfr && sed '':a;N;$!ba;s/\n/ /g'' tfr'
248248
- 'kubectl get psp #0 -o=jsonpath=''{.spec.requiredDropCapabilities}'''
249249
remediation: Create a PSP as described in the Kubernetes documentation, ensuring that the .spec.requiredDropCapabilities is set to include either NET_RAW or ALL.
250250
check_type: multi_param
@@ -259,7 +259,7 @@ categories:
259259
description: Do not generally permit containers with capabilities assigned beyond the default set.
260260
profile_applicability: Level 1 - Master Node
261261
audit:
262-
- kubectl get psp -o=custom-columns=:.metadata.name
262+
- kubectl get psp 2> /dev/null -o=custom-columns=:.metadata.name
263263
- 'tfr3=/dev/stdout && tfr2=/dev/stdout && kubectl get psp #0 -o=jsonpath=''{.spec.allowedCapabilities}'' > tfr3 && sed ''s/"/ /g'' tfr3 > tfr2 && sed ''s/[][]//g'' tfr2'
264264
remediation: Ensure that allowedCapabilities is not present in PSPs for the cluster unless it is set to an empty array.
265265
check_type: multi_param
@@ -274,7 +274,7 @@ categories:
274274
description: Do not generally permit containers with capabilities
275275
profile_applicability: Level 1 - Master Node
276276
audit:
277-
- 'tfr=/dev/stdout && kubectl get psp -o=custom-columns=:.metadata.name > tfr && sed '':a;N;$!ba;s/\n/ /g'' tfr'
277+
- 'tfr=/dev/stdout && kubectl get psp 2> /dev/null -o=custom-columns=:.metadata.name > tfr && sed '':a;N;$!ba;s/\n/ /g'' tfr'
278278
- 'kubectl get psp #0 -o=jsonpath=''{.spec.requiredDropCapabilities}'''
279279
remediation: Review the use of capabilites in applications runnning on your cluster. Where a namespace contains applicaions which do not require any Linux capabities to operate consider adding a PSP which forbids the admission of containers which do not drop all capabilities.
280280
check_type: multi_param

‎internal/benchmark/k8s/v1.6.0/5.0_policies.yml‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@ categories:
1212
environment and should be used only where and when needed.
1313
profile_applicability: Master
1414
audit:
15-
- tf=/dev/stdout && kubectl get clusterrolebindings -o=custom-columns=NAME:.metadata.name,ROLE:.roleRef.name,SUBJECT:.subjects[*].name
16-
|grep cluster-admin > tf && awk '{ print $3 }' tf
15+
- kubectl get clusterrolebindings -o=custom-columns=NAME:.metadata.name,ROLE:.roleRef.name,SUBJECT:.subjects[*].name
16+
|grep cluster-admin | awk '{ print $3 }'
1717
remediation: |-
1818
Identify all clusterrolebindings to the cluster-admin role. Check if they are used and if they need this role or if they could use a role with fewer privileges.
1919
Where possible, first bind users to a lower privileged role and then remove the clusterrolebinding to the cluster-admin role :
@@ -36,8 +36,8 @@ categories:
3636
of users to reduce the risk of privilege escalation.
3737
profile_applicability: Master
3838
audit:
39-
- tf=/dev/stdout && kubectl get clusterrolebindings -o=custom-columns=NAME:.metadata.name,ROLE:.roleRef.name,SUBJECT:.subjects[*].kind
40-
|grep User > tf && awk '{ print $1 }' tf
39+
- kubectl get clusterrolebindings -o=custom-columns=NAME:.metadata.name,ROLE:.roleRef.name,SUBJECT:.subjects[*].kind
40+
|grep User | awk '{ print $1 }'
4141
- 'kubectl auth can-i get secrets --all-namespaces --as #0'
4242
- kubectl auth can-i list secrets --all-namespaces --as=#0
4343
- kubectl auth can-i watch secrets --all-namespaces --as=#0
@@ -75,8 +75,8 @@ categories:
7575
As such, access to create new pods should be restricted to the smallest possible group of users.
7676
profile_applicability: Master
7777
audit:
78-
- tf=/dev/stdout && kubectl get clusterrolebindings -o=custom-columns=NAME:.metadata.name,ROLE:.roleRef.name,SUBJECT:.subjects[*].kind
79-
|grep User > tf && awk '{ print $1 }' tf
78+
- kubectl get clusterrolebindings -o=custom-columns=NAME:.metadata.name,ROLE:.roleRef.name,SUBJECT:.subjects[*].kind
79+
|grep User | awk '{ print $1 }'
8080
- 'kubectl auth can-i --all-namespaces --as #0 create pod'
8181
remediation: Where possible, remove create access to pod objects in the cluster.
8282
check_type: multi_param
@@ -138,7 +138,7 @@ categories:
138138
flag set to true.
139139
profile_applicability: Master
140140
audit:
141-
- kubectl get psp -o=custom-columns=:.metadata.name
141+
- kubectl get psp 2> /dev/null -o=custom-columns=:.metadata.name
142142
- 'kubectl get psp #0 -o=jsonpath=''{.spec.privileged}'''
143143
remediation: Create a PSP as described in the Kubernetes documentation, ensuring
144144
that the .spec.privileged field is omitted or set to false.
@@ -157,7 +157,7 @@ categories:
157157
set to true.
158158
profile_applicability: Master
159159
audit:
160-
- kubectl get psp -o=custom-columns=:.metadata.name
160+
- kubectl get psp 2> /dev/null -o=custom-columns=:.metadata.name
161161
- 'kubectl get psp #0 -o=jsonpath=''{.spec.hostPID}'''
162162
remediation: Create a PSP as described in the Kubernetes documentation, ensuring
163163
that the .spec.hostPID field is omitted or set to false.
@@ -175,7 +175,7 @@ categories:
175175
set to true.
176176
profile_applicability: Master
177177
audit:
178-
- kubectl get psp -o=custom-columns=:.metadata.name
178+
- kubectl get psp 2> /dev/null -o=custom-columns=:.metadata.name
179179
- 'kubectl get psp #0 -o=jsonpath=''{.spec.hostIPC}'''
180180
remediation: Create a PSP as described in the Kubernetes documentation, ensuring
181181
that the .spec.hostIPC field is omitted or set to false.
@@ -193,7 +193,7 @@ categories:
193193
flag set to true.
194194
profile_applicability: Level 1 - Master Node
195195
audit:
196-
- kubectl get psp -o=custom-columns=:.metadata.name
196+
- kubectl get psp 2> /dev/null -o=custom-columns=:.metadata.name
197197
- 'kubectl get psp #0 -o=jsonpath=''{.spec.hostNetwork}'''
198198
remediation: Create a PSP as described in the Kubernetes documentation, ensuring
199199
that the .spec.hostNetwork field is omitted or set to false.
@@ -210,7 +210,7 @@ categories:
210210
flag set to true.
211211
profile_applicability: Level 1 - Master Node
212212
audit:
213-
- kubectl get psp -o=custom-columns=:.metadata.name
213+
- kubectl get psp 2> /dev/null -o=custom-columns=:.metadata.name
214214
- 'kubectl get psp #0 -o=jsonpath=''{.spec.allowPrivilegeEscalation}'''
215215
remediation: Create a PSP as described in the Kubernetes documentation, ensuring
216216
that the .spec.allowPrivilegeEscalation field is omitted or set to false.
@@ -226,7 +226,7 @@ categories:
226226
description: Do not generally permit containers to be run as the root user.
227227
profile_applicability: Level 1 - Master Node
228228
audit:
229-
- kubectl get psp -o=custom-columns=:.metadata.name
229+
- kubectl get psp 2> /dev/null -o=custom-columns=:.metadata.name
230230
- 'kubectl get psp #0 -o=jsonpath=''{.spec.runAsUser.rule}'''
231231
remediation: Create a PSP as described in the Kubernetes documentation, ensuring that the .spec.runAsUser.rule is set to either MustRunAsNonRoot or MustRunAs with the range of UIDs not including 0.
232232
check_type: multi_param
@@ -240,7 +240,7 @@ categories:
240240
description: Do not generally permit containers with the potentially dangerous NET_RAW capability.
241241
profile_applicability: Level 1 - Master Node
242242
audit:
243-
- 'tfr=/dev/stdout && kubectl get psp -o=custom-columns=:.metadata.name > tfr && sed '':a;N;$!ba;s/\n/ /g'' tfr'
243+
- 'tfr=/dev/stdout && kubectl get psp 2> /dev/null -o=custom-columns=:.metadata.name > tfr && sed '':a;N;$!ba;s/\n/ /g'' tfr'
244244
- 'kubectl get psp #0 -o=jsonpath=''{.spec.requiredDropCapabilities}'''
245245
remediation: Create a PSP as described in the Kubernetes documentation, ensuring that the .spec.requiredDropCapabilities is set to include either NET_RAW or ALL.
246246
check_type: multi_param
@@ -255,7 +255,7 @@ categories:
255255
description: Do not generally permit containers with capabilities assigned beyond the default set.
256256
profile_applicability: Level 1 - Master Node
257257
audit:
258-
- kubectl get psp -o=custom-columns=:.metadata.name
258+
- kubectl get psp 2> /dev/null -o=custom-columns=:.metadata.name
259259
- 'tfr3=/dev/stdout && tfr2=/dev/stdout && kubectl get psp #0 -o=jsonpath=''{.spec.allowedCapabilities}'' > tfr3 && sed ''s/"/ /g'' tfr3 > tfr2 && sed ''s/[][]//g'' tfr2'
260260
remediation: Ensure that allowedCapabilities is not present in PSPs for the cluster unless it is set to an empty array.
261261
check_type: multi_param
@@ -270,7 +270,7 @@ categories:
270270
description: Do not generally permit containers with capabilities
271271
profile_applicability: Level 1 - Master Node
272272
audit:
273-
- 'tfr=/dev/stdout && kubectl get psp -o=custom-columns=:.metadata.name > tfr && sed '':a;N;$!ba;s/\n/ /g'' tfr'
273+
- 'tfr=/dev/stdout && kubectl get psp 2> /dev/null -o=custom-columns=:.metadata.name > tfr && sed '':a;N;$!ba;s/\n/ /g'' tfr'
274274
- 'kubectl get psp #0 -o=jsonpath=''{.spec.requiredDropCapabilities}'''
275275
remediation: Review the use of capabilites in applications runnning on your cluster. Where a namespace contains applicaions which do not require any Linux capabities to operate consider adding a PSP which forbids the admission of containers which do not drop all capabilities.
276276
check_type: multi_param

‎internal/cli/commands/k8s-audit.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -251,6 +251,9 @@ func (bk *K8sAudit) evalExpression(at *models.AuditBench,
251251
for _, o := range outputs {
252252
permutationArr = append(permutationArr, o)
253253
testFailure = bk.evalExpression(at, commandRes[1:commResSize], commResSize-1, permutationArr, testFailure, log)
254+
if testFailure > 0 {
255+
return testFailure
256+
}
254257
permutationArr = permutationArr[:len(permutationArr)-1]
255258
}
256259
return testFailure

0 commit comments

Comments
 (0)