Skip to content

Conversation

@Redent0r
Copy link

@Redent0r Redent0r commented Feb 11, 2025

Merge Checklist
Summary

policy: improve args and env variables validation. See commits for details

Depends on:

Test Methodology

Passing all fork samples locally
test run:

@Redent0r Redent0r added the upstream/missing PRs that are yet to be upstreamed label Feb 11, 2025
@Redent0r Redent0r force-pushed the saulparedes/improve_arg_validation branch 2 times, most recently from 1ab8fa6 to 05b6c7b Compare February 19, 2025 21:43
@Redent0r Redent0r force-pushed the saulparedes/improve_arg_validation branch 7 times, most recently from 5ab2596 to f6f8fa7 Compare February 27, 2025 00:02
@Redent0r Redent0r mentioned this pull request Feb 27, 2025
4 tasks
@Redent0r Redent0r marked this pull request as ready for review February 27, 2025 18:17
@Redent0r Redent0r requested review from a team as code owners February 27, 2025 18:17
@Redent0r Redent0r force-pushed the saulparedes/improve_arg_validation branch from f6f8fa7 to 3f98aca Compare February 28, 2025 00:20
@Redent0r Redent0r requested a review from danmihai1 February 28, 2025 00:28
@Redent0r Redent0r force-pushed the saulparedes/improve_arg_validation branch from 3f98aca to a151089 Compare February 28, 2025 18:36
@Redent0r Redent0r requested a review from manuelh-dev February 28, 2025 18:43
PolicyCreateContainerRequest will be a wrapper to CreateContainerRequest and will allow
the agent to transform the input such that is easier to validate in the policy.

Signed-off-by: Saul Paredes <[email protected]>
- Add environment variable map to the engine on the agent
- Add environment variable map to the policy on genpolicy
- Validate this environemnt variable map on the rules
- Restrain some environment variable values that we expect to look like a subdomain and use a regex to validate them

Signed-off-by: Saul Paredes <[email protected]>
- Mark old arg validation methods as deprecated
- Mark old arg policy data field as deprecated

Signed-off-by: Saul Paredes <[email protected]>
Add a new rule that validates args by substituting env variables received from the input.

This new rule ensures that the args received from the input are the same as the args received from the policy.

Signed-off-by: Saul Paredes <[email protected]>
Update samples

Signed-off-by: Saul Paredes <[email protected]>
@Redent0r Redent0r force-pushed the saulparedes/improve_arg_validation branch from a151089 to 35b666c Compare February 28, 2025 20:51
@Redent0r
Copy link
Author

Force pushed to rebase against latest msft-main

@Redent0r Redent0r merged commit 597f2dc into msft-main Feb 28, 2025
45 of 55 checks passed
@Redent0r Redent0r deleted the saulparedes/improve_arg_validation branch February 28, 2025 23:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

upstream/missing PRs that are yet to be upstreamed

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants