Skip to content

Security Standards for both Windows and Linux #29855

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
ravisantoshgudimetla wants to merge 1 commit into from
Closed

Security Standards for both Windows and Linux #29855

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 13 additions & 13 deletions content/en/docs/concepts/security/pod-security-standards.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,7 +76,7 @@ fail validation.
<tr>
<td style="white-space: nowrap">Host Namespaces</td>
<td>
<p>Sharing the host namespaces must be disallowed.</p>
<p>Sharing the host namespaces must be disallowed. This is a Linux specific field and should not be used for Windows Pods.</p>

@s-urbaniak s-urbaniak Sep 29, 2021

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

does it make sense to mention the fact that this will be effectively only possible with the new Windows KEP being in place?

@liggitt liggitt Sep 29, 2021

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we would not add OS-specific docs to this check... no matter the OS of the pod, this policy would disallow this field

@ravisantoshgudimetla ravisantoshgudimetla Sep 29, 2021

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So, what should the admission plugin do? Throw an error saying:

This field is not allowed when baseline policy is enabled?

or

This field is not allowed for Windows pod and cannot be used with baseline profile even for linux pods to give user a more specific error?

or are you saying let's not update the docs for OS specific fields if they are already validated based on values(sometimes nil or undefined etc).

@liggitt liggitt Sep 29, 2021 •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All the checks that forbid specific fields/values can remain unchanged, even if those fields are OS-specific. For example, the baseline policy can forbid privileged: true, regardless of whether the pod is a windows pod or not.

(API validation could additionally complain if you set a linux-specific field on an explicitly windows pod, but that would not be done by the pod security admission plugin)

The checks that currently require specific fields to be set (which are all in the restricted policy) are what we would make conditional on the pod OS.

@ravisantoshgudimetla ravisantoshgudimetla Sep 29, 2021

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(API validation could additionally complain if you set a linux-specific field on an explicitly windows pod, but that would not be done by the pod security admission plugin)

I am doing it here - kubernetes/kubernetes#104693

The checks that currently require specific fields to be set (which are all in the restricted policy) are what we would make conditional on the pod OS.

Ok, I'll make changes to restricted profile only then.

<p><strong>Restricted Fields</strong></p>
<ul>
<li><code>spec.hostNetwork</code></li>
Expand All @@ -93,7 +93,7 @@ fail validation.
<tr>
<td style="white-space: nowrap">Privileged Containers</td>
<td>
<p>Privileged Pods disable most security mechanisms and must be disallowed.</p>
<p>Privileged Pods disable most security mechanisms and must be disallowed. This is a Linux specific field and should not be used for Windows Pods.</p>

@liggitt liggitt Sep 29, 2021

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we would not add OS-specific docs to this check... no matter the OS of the pod, this policy would disallow this field

@ravisantoshgudimetla ravisantoshgudimetla Sep 29, 2021

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So, what should the admission plugin do? Throw an error saying:

This field is not allowed when baseline policy is enabled?

or

This field is not allowed for Windows pod and cannot be used with baseline profile even for linux pods to give user a more specific error?

<p><strong>Restricted Fields</strong></p>
<ul>
<li><code>spec.containers[*].securityContext.privileged</code></li>
Expand All @@ -110,7 +110,7 @@ fail validation.
<tr>
<td style="white-space: nowrap">Capabilities</td>
<td>
<p>Adding additional capabilities beyond those listed below must be disallowed.</p>
<p>Adding additional capabilities beyond those listed below must be disallowed. This is a Linux specific field and should not be used for Windows Pods.</p>

@liggitt liggitt Sep 29, 2021

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we would not add OS-specific docs to this check... no matter the OS of the pod, this policy would disallow this field

@ravisantoshgudimetla ravisantoshgudimetla Sep 29, 2021

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So, what should the admission plugin do? Throw an error saying:

This field is not allowed when baseline policy is enabled?

or

This field is not allowed for Windows pod and cannot be used with baseline profile even for linux pods to give user a more specific error?

<p><strong>Restricted Fields</strong></p>
<ul>
<li><code>spec.containers[*].securityContext.capabilities.add</code></li>
Expand Down Expand Up @@ -171,7 +171,7 @@ fail validation.
<tr>
<td style="white-space: nowrap">AppArmor</td>
<td>
<p>On supported hosts, the <code>runtime/default</code> AppArmor profile is applied by default. The baseline policy should prevent overriding or disabling the default AppArmor profile, or restrict overrides to an allowed set of profiles.</p>
<p>On supported hosts, the <code>runtime/default</code> AppArmor profile is applied by default. The baseline policy should prevent overriding or disabling the default AppArmor profile, or restrict overrides to an allowed set of profiles. This is a Linux specific field and should not be used for Windows Pods.</p>

@liggitt liggitt Sep 29, 2021

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we would not add OS-specific docs to this check... no matter the OS of the pod, this policy should be enforced (since it permits an undefined value)

@ravisantoshgudimetla ravisantoshgudimetla Sep 29, 2021

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So, if the field permits undefined values, we should let the pod security validation pass if there are undefined values? I thought we can outright reject pods if they have mismatched fields(based on OS) in the pod or container security context

<p><strong>Restricted Fields</strong></p>
<ul>
<li><code>metadata.annotations["container.apparmor.security.beta.kubernetes.io/*"]</code></li>
Expand All @@ -187,7 +187,7 @@ fail validation.
<tr>
<td style="white-space: nowrap">SELinux</td>
<td>
<p>Setting the SELinux type is restricted, and setting a custom SELinux user or role option is forbidden.</p>
<p>Setting the SELinux type is restricted, and setting a custom SELinux user or role option is forbidden. This is a Linux specific field and should not be used for Windows Pods.</p>

@liggitt liggitt Sep 29, 2021

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we would not add OS-specific docs to this check... no matter the OS of the pod, this policy should be enforced (since it permits omitting the field)

@ravisantoshgudimetla ravisantoshgudimetla Sep 29, 2021 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So, if the field permits undefined values, we should let the pod security validation pass? I thought we can outright reject pods if they have mismatched fields in the pod or container security context

<p><strong>Restricted Fields</strong></p>
<ul>
<li><code>spec.securityContext.seLinuxOptions.type</code></li>
Expand Down Expand Up @@ -223,7 +223,7 @@ fail validation.
<tr>
<td style="white-space: nowrap"><code>/proc</code> Mount Type</td>
<td>
<p>The default <code>/proc</code> masks are set up to reduce attack surface, and should be required.</p>
<p>The default <code>/proc</code> masks are set up to reduce attack surface, and should be required. This is a Linux specific field and should not be used for Windows Pods.</p>
<p><strong>Restricted Fields</strong></p>
<ul>
<li><code>spec.containers[*].securityContext.procMount</code></li>
Expand All @@ -240,7 +240,7 @@ fail validation.
<tr>
<td>Seccomp</td>
<td>
<p>Seccomp profile must not be explicitly set to <code>Unconfined</code>.</p>
<p>Seccomp profile must not be explicitly set to <code>Unconfined</code>. This is a Linux specific field and should not be used for Windows Pods.</p>
<p><strong>Restricted Fields</strong></p>
<ul>
<li><code>spec.securityContext.seccompProfile.type</code></li>
Expand All @@ -259,7 +259,7 @@ fail validation.
<tr>
<td style="white-space: nowrap">Sysctls</td>
<td>
<p>Sysctls can disable security mechanisms or affect all containers on a host, and should be disallowed except for an allowed "safe" subset. A sysctl is considered safe if it is namespaced in the container or the Pod, and it is isolated from other Pods or processes on the same Node.</p>
<p>Sysctls can disable security mechanisms or affect all containers on a host, and should be disallowed except for an allowed "safe" subset. A sysctl is considered safe if it is namespaced in the container or the Pod, and it is isolated from other Pods or processes on the same Node. This is a Linux specific field and should not be used for Windows Pods. </p>
<p><strong>Restricted Fields</strong></p>
<ul>
<li><code>spec.securityContext.sysctls[*].name</code></li>
Expand Down Expand Up @@ -339,7 +339,7 @@ fail validation.
<tr>
<td style="white-space: nowrap">Privilege Escalation (v1.8+)</td>
<td>
<p>Privilege escalation (such as via set-user-ID or set-group-ID file mode) should not be allowed.</p>
<p>Privilege escalation (such as via set-user-ID or set-group-ID file mode) should not be allowed. This is a Linux specific field and should not be used for Windows Pods.</p>
<p><strong>Restricted Fields</strong></p>
<ul>
<li><code>spec.containers[*].securityContext.allowPrivilegeEscalation</code></li>
Expand All @@ -355,7 +355,7 @@ fail validation.
<tr>
<td style="white-space: nowrap">Running as Non-root</td>
<td>
<p>Containers must be required to run as non-root users.</p>
<p>Containers must be required to run as non-root users. This is a Linux specific field and should not be used for Windows Pods.</p>
<p><strong>Restricted Fields</strong></p>
<ul>
<li><code>spec.securityContext.runAsNonRoot</code></li>
Expand All @@ -374,7 +374,7 @@ fail validation.
</td>
</tr>
<tr>
<td style="white-space: nowrap">Non-root groups <em>(optional)</em></td>
<td style="white-space: nowrap">Non-root groups <em>(optional)</em>. This is a Linux specific field and should not be used for Windows Pods.</td>
<td>
<p>Containers should be forbidden from running with a root primary or supplementary GID.</p>
<p><strong>Restricted Fields</strong></p>
Expand All @@ -396,7 +396,7 @@ fail validation.
<tr>
<td style="white-space: nowrap">Seccomp (v1.19+)</td>
<td>
<p>Seccomp profile must be explicitly set to one of the allowed values. Both the <code>Unconfined</code> profile and the <em>absence</em> of a profile are prohibited.</p>
<p>Seccomp profile must be explicitly set to one of the allowed values. Both the <code>Unconfined</code> profile and the <em>absence</em> of a profile are prohibited. This is a Linux specific field and should not be used for Windows Pods.</p>

@liggitt liggitt Sep 29, 2021

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This check WILL be OS-specific once that support is added to pods, and will not apply to windows pods, but we should not update this doc until that feature lands (planned for alpha in 1.23)

@ravisantoshgudimetla ravisantoshgudimetla Sep 29, 2021

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Right. This PR is supposed to merge after the code changes are in place.

<p><strong>Restricted Fields</strong></p>
<ul>
<li><code>spec.securityContext.seccompProfile.type</code></li>
Expand All @@ -422,7 +422,7 @@ fail validation.
<td>
<p>
Containers must drop <code>ALL</code> capabilities, and are only permitted to add back

@liggitt liggitt Sep 29, 2021

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This check WILL be OS-specific once that support is added to pods, and will not apply to windows pods, but we should not update this doc until that feature lands (planned for alpha in 1.23)

@ravisantoshgudimetla ravisantoshgudimetla Sep 29, 2021

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Right. This PR is supposed to merge after the code changes are in place.

@sftim sftim Sep 29, 2021

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See kubernetes/enhancements#2802 (comment) for the request for docs.

the <code>NET_BIND_SERVICE</code> capability.
the <code>NET_BIND_SERVICE</code> capability. This is a Linux specific field and should not be used for Windows Pods.
</p>
<p><strong>Restricted Fields</strong></p>
<ul>
Expand Down