Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Harden the spo and bpf-recorder containers with custom apparmor profiles #2646

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Harden the spo and bpf-recorder containers with custom apparmor profiles #2646

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
eab0a2b
Harden the spo and bpf-recorder containers with custom apparmor profiles
ccojocar Dec 23, 2024
98734a7
Fix typos
ccojocar Dec 23, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 10 additions & 1 deletion cmd/security-profiles-operator/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -184,6 +184,12 @@ func main() {
Value: "",
Usage: "the container runtime in the cluster (values: cri-o, containerd, docker)",
},
&cli.BoolFlag{
Name: "apparmor",
Aliases: []string{"a"},
Usage: "enable installation of apparmor profiles for spo",
EnvVars: []string{config.AppArmorEnvKey},
},
},
},
&cli.Command{
Expand Down Expand Up @@ -261,7 +267,9 @@ func initLogging(ctx *cli.Context) error {
return fmt.Errorf("parse verbosity flag: %w", err)
}

ctrl.SetLogger(ctrl.Log.V(int(level)))
ctrl.Log.Info(fmt.Sprintf("Set logging verbosity to %d", level))

return nil
}

Expand Down Expand Up @@ -521,6 +529,7 @@ func runNonRootEnabler(ctx *cli.Context, info *version.Info) error {
const component = "non-root-enabler"
printInfo(component, info)
runtime := ctx.String("runtime")
apparmor := ctx.Bool("apparmor")

cfg, err := ctrl.GetConfig()
if err != nil {
Expand All @@ -534,7 +543,7 @@ func runNonRootEnabler(ctx *cli.Context, info *version.Info) error {
if err != nil {
kubeletDir = config.KubeletDir()
}
return nonrootenabler.New().Run(ctrl.Log.WithName(component), runtime, kubeletDir)
return nonrootenabler.New().Run(ctrl.Log.WithName(component), runtime, kubeletDir, apparmor)
}

func runWebhook(ctx *cli.Context, info *version.Info) error {
Expand Down
2 changes: 2 additions & 0 deletions deploy/base/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,8 @@ configMapGenerator:
- profiles/selinuxd.cil
- profiles/selinuxrecording.cil
- profiles/selinuxd-image-mapping.json
- profiles/spo-apparmor.yaml
- profiles/bpfrecorder-apparmor.yaml
name: security-profiles-operator-profile

generatorOptions:
Expand Down
54 changes: 54 additions & 0 deletions deploy/base/profiles/bpfrecorder-apparmor.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,54 @@
apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
kind: AppArmorProfile
metadata:
labels:
spo.x-k8s.io/container-id: bpf-recorder
name: bpfrecorder-apparmor
namespace: security-profiles-operator
spec:
abstract:
capability:
allowedCapabilities:
- bpf
- chown
- dac_override
- dac_read_search
- mknod
- perfmon
- setgid
- setuid
- sys_admin
- sys_resource
executable:
allowedExecutables:
- /security-profiles-operator
filesystem:
readOnlyPaths:
- /
- /proc/@{pid}/cgroup
- /proc/@{pid}/fd/
- /proc/@{pid}/maps
- /proc/@{pid}/mountinfo
- /proc/@{pid}/setgroups
- /proc/@{pid}/status
- /proc/@{pid}/uid_map
- /proc/filesystems
- /proc/sys/kernel/cap_last_cap
- /proc/sys/net/core/somaxconn
- /sys/devices/kprobe/type
- /sys/devices/system/cpu/online
- /sys/fs/bpf/
- /sys/kernel/btf/vmlinux
- /sys/kernel/debug/tracing/events/raw_syscalls/sys_enter/id
- /sys/kernel/debug/tracing/events/sched/sched_process_exec/id
- /sys/kernel/debug/tracing/events/sched/sched_process_exit/id
- /sys/kernel/debug/tracing/events/syscalls/sys_enter_socket/id
- /sys/kernel/mm/transparent_hugepage/hpage_pmd_size
- /sys/kernel/security/lsm
readWritePaths:
- /dev/null
network:
allowedProtocols:
allowTcp: true
allowUdp: true
disabled: false
48 changes: 48 additions & 0 deletions deploy/base/profiles/spo-apparmor.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,48 @@
apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
kind: AppArmorProfile
metadata:
labels:
spo.x-k8s.io/container-id: security-profiles-operator
name: spo-apprmor
namespace: security-profiles-operator
spec:
abstract:
capability:
allowedCapabilities:
- chown
- dac_override
- dac_read_search
- fowner
- fsetid
- mknod
- setgid
- setpcap
- setuid
- sys_admin
executable:
allowedExecutables:
- /security-profiles-operator
filesystem:
readOnlyPaths:
- /
- /opt/spo-profiles/**
- /proc/@{pid}/fd/
- /proc/@{pid}/maps
- /proc/@{pid}/mountinfo
- /proc/@{pid}/setgroups
- /proc/@{pid}/status
- /proc/@{pid}/uid_map
- /proc/filesystems
- /proc/sys/kernel/cap_last_cap
- /proc/sys/net/core/somaxconn
- /sys/kernel/mm/transparent_hugepage/hpage_pmd_size
readWritePaths:
- /dev/null
- /host/var/lib/kubelet/seccomp/**
- /var/lib/security-profiles-operator/kubelet-config.json
network:
allowedProtocols:
allowTcp: true
allowUdp: true
disabled: false

104 changes: 104 additions & 0 deletions deploy/helm/templates/static-resources.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -789,6 +789,61 @@ data:
}
]
}
bpfrecorder-apparmor.yaml: |
apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
kind: AppArmorProfile
metadata:
labels:
spo.x-k8s.io/container-id: bpf-recorder
name: bpfrecorder-apparmor
namespace: security-profiles-operator
spec:
abstract:
capability:
allowedCapabilities:
- bpf
- chown
- dac_override
- dac_read_search
- mknod
- perfmon
- setgid
- setuid
- sys_admin
- sys_resource
executable:
allowedExecutables:
- /security-profiles-operator
filesystem:
readOnlyPaths:
- /
- /proc/@{pid}/cgroup
- /proc/@{pid}/fd/
- /proc/@{pid}/maps
- /proc/@{pid}/mountinfo
- /proc/@{pid}/setgroups
- /proc/@{pid}/status
- /proc/@{pid}/uid_map
- /proc/filesystems
- /proc/sys/kernel/cap_last_cap
- /proc/sys/net/core/somaxconn
- /sys/devices/kprobe/type
- /sys/devices/system/cpu/online
- /sys/fs/bpf/
- /sys/kernel/btf/vmlinux
- /sys/kernel/debug/tracing/events/raw_syscalls/sys_enter/id
- /sys/kernel/debug/tracing/events/sched/sched_process_exec/id
- /sys/kernel/debug/tracing/events/sched/sched_process_exit/id
- /sys/kernel/debug/tracing/events/syscalls/sys_enter_socket/id
- /sys/kernel/mm/transparent_hugepage/hpage_pmd_size
- /sys/kernel/security/lsm
readWritePaths:
- /dev/null
network:
allowedProtocols:
allowTcp: true
allowUdp: true
disabled: false
security-profiles-operator.json: |
{
"defaultAction": "SCMP_ACT_ERRNO",
Expand Down Expand Up @@ -955,6 +1010,55 @@ data:
(blockinherit container)
(typepermissive process)
)
spo-apparmor.yaml: |+
apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
kind: AppArmorProfile
metadata:
labels:
spo.x-k8s.io/container-id: security-profiles-operator
name: spo-apprmor
namespace: security-profiles-operator
spec:
abstract:
capability:
allowedCapabilities:
- chown
- dac_override
- dac_read_search
- fowner
- fsetid
- mknod
- setgid
- setpcap
- setuid
- sys_admin
executable:
allowedExecutables:
- /security-profiles-operator
filesystem:
readOnlyPaths:
- /
- /opt/spo-profiles/**
- /proc/@{pid}/fd/
- /proc/@{pid}/maps
- /proc/@{pid}/mountinfo
- /proc/@{pid}/setgroups
- /proc/@{pid}/status
- /proc/@{pid}/uid_map
- /proc/filesystems
- /proc/sys/kernel/cap_last_cap
- /proc/sys/net/core/somaxconn
- /sys/kernel/mm/transparent_hugepage/hpage_pmd_size
readWritePaths:
- /dev/null
- /host/var/lib/kubelet/seccomp/**
- /var/lib/security-profiles-operator/kubelet-config.json
network:
allowedProtocols:
allowTcp: true
allowUdp: true
disabled: false

kind: ConfigMap
metadata:
annotations:
Expand Down
104 changes: 104 additions & 0 deletions deploy/namespace-operator.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3072,6 +3072,61 @@ data:
}
]
}
bpfrecorder-apparmor.yaml: |
apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
kind: AppArmorProfile
metadata:
labels:
spo.x-k8s.io/container-id: bpf-recorder
name: bpfrecorder-apparmor
namespace: security-profiles-operator
spec:
abstract:
capability:
allowedCapabilities:
- bpf
- chown
- dac_override
- dac_read_search
- mknod
- perfmon
- setgid
- setuid
- sys_admin
- sys_resource
executable:
allowedExecutables:
- /security-profiles-operator
filesystem:
readOnlyPaths:
- /
- /proc/@{pid}/cgroup
- /proc/@{pid}/fd/
- /proc/@{pid}/maps
- /proc/@{pid}/mountinfo
- /proc/@{pid}/setgroups
- /proc/@{pid}/status
- /proc/@{pid}/uid_map
- /proc/filesystems
- /proc/sys/kernel/cap_last_cap
- /proc/sys/net/core/somaxconn
- /sys/devices/kprobe/type
- /sys/devices/system/cpu/online
- /sys/fs/bpf/
- /sys/kernel/btf/vmlinux
- /sys/kernel/debug/tracing/events/raw_syscalls/sys_enter/id
- /sys/kernel/debug/tracing/events/sched/sched_process_exec/id
- /sys/kernel/debug/tracing/events/sched/sched_process_exit/id
- /sys/kernel/debug/tracing/events/syscalls/sys_enter_socket/id
- /sys/kernel/mm/transparent_hugepage/hpage_pmd_size
- /sys/kernel/security/lsm
readWritePaths:
- /dev/null
network:
allowedProtocols:
allowTcp: true
allowUdp: true
disabled: false
security-profiles-operator.json: |
{
"defaultAction": "SCMP_ACT_ERRNO",
Expand Down Expand Up @@ -3238,6 +3293,55 @@ data:
(blockinherit container)
(typepermissive process)
)
spo-apparmor.yaml: |+
apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
kind: AppArmorProfile
metadata:
labels:
spo.x-k8s.io/container-id: security-profiles-operator
name: spo-apprmor
namespace: security-profiles-operator
spec:
abstract:
capability:
allowedCapabilities:
- chown
- dac_override
- dac_read_search
- fowner
- fsetid
- mknod
- setgid
- setpcap
- setuid
- sys_admin
executable:
allowedExecutables:
- /security-profiles-operator
filesystem:
readOnlyPaths:
- /
- /opt/spo-profiles/**
- /proc/@{pid}/fd/
- /proc/@{pid}/maps
- /proc/@{pid}/mountinfo
- /proc/@{pid}/setgroups
- /proc/@{pid}/status
- /proc/@{pid}/uid_map
- /proc/filesystems
- /proc/sys/kernel/cap_last_cap
- /proc/sys/net/core/somaxconn
- /sys/kernel/mm/transparent_hugepage/hpage_pmd_size
readWritePaths:
- /dev/null
- /host/var/lib/kubelet/seccomp/**
- /var/lib/security-profiles-operator/kubelet-config.json
network:
allowedProtocols:
allowTcp: true
allowUdp: true
disabled: false

kind: ConfigMap
metadata:
labels:
Expand Down
Loading
Loading