Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixes bug #1787 non-k8s: KubeArmor panics when not-enabled policy type is received #1789

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

itsCheithanya
Copy link

This fixes the bug that KubeArmor panics when not-enabled policy type is being received
Reproduce the issue :
Modify make run target in KubeArmor's Makefile to something like below such that host policy is disabled:

 cd $(CURDIR); DEBUG=true sudo -E ./kubearmor -k8s=false -logPath=/tmp/kubearmor.log -enableKubeArmorPolicy -defaultFilePosture block -defaultCapabilitiesPosture block -defaultNetworkPosture block 

Once KubeArmor is running, send the below host policy by running karmor vm policy --gRPC=:32767 add <path-to-policy> :


apiVersion: security.kubearmor.com/v1
kind: KubeArmorHostPolicy
metadata:
  name: hsp-block-sleep
spec:
  severity: 10
  message: "sleep was attempted to be executed"
  tags:
  - ALERT
  nodeSelector:
    matchLabels:
      kubearmor.io/hostname: '*'
  process:
    matchPaths:
    - path: /usr/bin/sleep
  action:
    Block

image
You'll see that KubeArmor doesn't panic :
image

Fixes #1787

If the changes in this PR are manually verified, list down the scenarios covered::

Additional information for reviewer? :
Mention if this PR is part of any design or a continuation of previous PRs

Checklist:

  • Bug fix. Fixes non-k8s: KubeArmor panics when not-enabled policy type is received #1787
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • This change requires a documentation update
  • PR Title follows the convention of <type>(<scope>): <subject>
  • Commit has unit tests
  • Commit has integration tests

Copy link
Member

@DelusionalOptimist DelusionalOptimist left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @itsCheithanya!
Minor changes to address... Looking good otherwise.

KubeArmor/policy/policy.go Outdated Show resolved Hide resolved
KubeArmor/policy/policy.go Outdated Show resolved Hide resolved
KubeArmor/policy/policy.go Outdated Show resolved Hide resolved
Copy link
Member

@DelusionalOptimist DelusionalOptimist left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for addressing the changes.
Please see the comments inline @itsCheithanya

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Did you build the code after adding this change?
Just try running make build once and you'll see come changes in policy.pb.go in the protobuf directory. Please add that as well.
And then you can use the generated constant in pb.PolicyStatus_NotEnabled in policy.go

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ohh okay my bad missed that will do

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

image
Getting Policy 6 instead of Policy NotEnabled
what could be the reason?

Copy link
Member

@DelusionalOptimist DelusionalOptimist Jul 3, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, @itsCheithanya once we merge this PR we'll need to update the proto package in kubearmor-client so that it can understand this error code.
For now it's fine, let's do it after we address all the changes and merge this PR.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@itsCheithanya you have to build the client after updating the github.com/kubearmor/KubeArmor/protobuf dependecy in karmor client.

res := new(pb.Response)
if !p.HostPolicyEnabled {
res.Status = pb.PolicyStatus_Invalid
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
res.Status = pb.PolicyStatus_Invalid
res.Status = pb.PolicyStatus_NotEnabled

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

non-k8s: KubeArmor panics when not-enabled policy type is received
3 participants