genpolicy: Introduce UpdateRoutesRequest, UpdateInterfaceRequest rules in genpolicy-settings

src/tools/genpolicy/genpolicy-settings.json

@@ -324,13 +324,31 @@
             ],
             "allow_env_regex_map": {}
         },
+        "UpdateInterfaceRequest": {
+            "allow_raw_flags": 128,
+            "forbidden_names": [
+                "lo"
+            ],
+            "forbidden_hw_addrs": [
+                "00:00:00:00:00:00"
+            ]
+        },
         "CopyFileRequest": [
             "$(sfprefix)"
         ],
         "ExecProcessRequest": {
             "commands": [],
             "regex": []
         },
+        "UpdateRoutesRequest": {
+            "forbidden_device_names": [
+                "lo"
+            ],
+            "forbidden_source_regex": [
+                "^(?:0{0,4}:){0,7}0{0,3}1$",
+                "^127\\.(?:[0-9]{1,3}\\.){2}[0-9]{1,3}$"
+            ]
+        },
         "CloseStdinRequest": false,
         "ReadStreamRequest": false,
         "UpdateEphemeralMountsRequest": false,

src/tools/genpolicy/rules.rego

@@ -38,8 +38,8 @@ default StopTracingRequest := false
 default TtyWinResizeRequest := true
 default UpdateContainerRequest := false
 default UpdateEphemeralMountsRequest := false
-default UpdateInterfaceRequest := true
-default UpdateRoutesRequest := true
+default UpdateInterfaceRequest := false
+default UpdateRoutesRequest := false
 default WaitProcessRequest := true
 default WriteStreamRequest := false
 
@@ -1633,6 +1633,49 @@ ExecProcessRequest {
     print("ExecProcessRequest 3: true")
 }
 
+UpdateRoutesRequest {
+    print("UpdateRoutesRequest: input =", input)
+    print("UpdateRoutesRequest: policy =", policy_data.request_defaults.UpdateRoutesRequest)
+
+    i_routes := input.routes.Routes
+    p_source_regex = policy_data.request_defaults.UpdateRoutesRequest.forbidden_source_regex
+    p_names = policy_data.request_defaults.UpdateRoutesRequest.forbidden_device_names
+
+    every i_route in i_routes {
+        print("i_route.source =", i_route.source)
+        every p_regex in p_source_regex {
+            print("p_regex =", p_regex)
+            not regex.match(p_regex, i_route.source)
+        }
+
+        print("i_route.device =", i_route.device)
+        not i_route.device in p_names
+    }
+
+    print("UpdateRoutesRequest: true")
+}
+
+UpdateInterfaceRequest {
+    print("UpdateInterfaceRequest: input =", input)
+    print("UpdateInterfaceRequest: policy =", policy_data.request_defaults.UpdateInterfaceRequest)
+
+    i_interface := input.interface
+    p_flags := policy_data.request_defaults.UpdateInterfaceRequest.allow_raw_flags
+
+    # Typically, just IFF_NOARP is used.
+    bits.and(i_interface.raw_flags, bits.negate(p_flags)) == 0
+
+    p_names := policy_data.request_defaults.UpdateInterfaceRequest.forbidden_names
+
+    not i_interface.name in p_names
+
+    p_hwaddrs := policy_data.request_defaults.UpdateInterfaceRequest.forbidden_hw_addrs
+
+    not i_interface.hwAddr in p_hwaddrs
+
+    print("UpdateInterfaceRequest: true")
+}
+
 CloseStdinRequest {
     policy_data.request_defaults.CloseStdinRequest == true
 }

src/tools/genpolicy/src/policy.rs

@@ -327,6 +327,29 @@ pub struct ExecProcessRequestDefaults {
     regex: Vec<String>,
 }
 
+/// UpdateRoutesRequest settings from genpolicy-settings.json.
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct UpdateRoutesRequestDefaults {
+    /// Forbid adding routes to devices of these names.
+    forbidden_device_names: Vec<String>,
+
+    /// Forbid adding routes originating from these addresses.
+    forbidden_source_regex: Vec<String>,
+}
+
+/// UpdateInterfaceRequest settings from genpolicy-settings.json.
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct UpdateInterfaceRequestDefaults {
+    /// Raw flag bitmask explicitly allowed to configure
+    allow_raw_flags: u32,
+
+    /// Explicitly blocked interface names. Intent is to block changes to loopback interface.
+    forbidden_names: Vec<String>,
+
+    /// Explicitly blocked mac addresses. Intent is to block changes to loopback interface.
+    forbidden_hw_addrs: Vec<String>,
+}
+
 /// Settings specific to each kata agent endpoint, loaded from
 /// genpolicy-settings.json.
 #[derive(Clone, Debug, Serialize, Deserialize)]
@@ -340,6 +363,12 @@ pub struct RequestDefaults {
     /// Commands allowed to be executed by the Host in all Guest containers.
     pub ExecProcessRequest: ExecProcessRequestDefaults,
 
+    /// Allow the host to update routes for devices other than the loopback.
+    pub UpdateRoutesRequest: UpdateRoutesRequestDefaults,
+
+    /// Allow the host to configure only used raw_flags and reject names/mac addresses of the loopback.
+    pub UpdateInterfaceRequest: UpdateInterfaceRequestDefaults,
+
     /// Allow the Host to close stdin for a container. Typically used with WriteStreamRequest.
     pub CloseStdinRequest: bool,
 

src/tools/genpolicy/tests/main.rs

@@ -11,7 +11,7 @@ mod tests {
     use std::path;
     use std::str;
 
-    use protocols::agent::CreateSandboxRequest;
+    use protocols::agent::{CreateSandboxRequest, UpdateInterfaceRequest, UpdateRoutesRequest};
     use serde::de::DeserializeOwned;
     use serde::{Deserialize, Serialize};
 
@@ -142,4 +142,14 @@ mod tests {
     async fn test_create_sandbox() {
         runtests::<CreateSandboxRequest>("createsandbox").await;
     }
+
+    #[tokio::test]
+    async fn test_update_routes() {
+        runtests::<UpdateRoutesRequest>("updateroutes").await;
+    }
+
+    #[tokio::test]
+    async fn test_update_interface() {
+        runtests::<UpdateInterfaceRequest>("updateinterface").await;
+    }
 }

src/tools/genpolicy/tests/testdata/updateinterface/pod.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: dummy
+spec:
+  runtimeClassName: kata-cc-isolation
+  containers:
+  - name: dummy
+    image: registry.k8s.io/pause:3.6@sha256:3d380ca8864549e74af4b29c10f9cb0956236dfb01c40ca076fb6c37253234db

src/tools/genpolicy/tests/testdata/updateinterface/testcases.json

@@ -0,0 +1,97 @@
+[
+  {
+    "description": "no flags",
+    "allowed": true,
+    "request": {
+      "interface": {
+          "device": "eth0",
+          "name": "eth0",
+          "IPAddresses": [
+              {"family":0, "address":"10.244.0.14", "mask":"24"},
+              {"family":1, "address":"fe80::6474:9fff:fe6a:9601", "mask":"64"}
+          ],
+          "mtu": 1500,
+          "hwAddr": "66:74:9f:6a:96:01",
+          "pciPath": "",
+          "type_": "",
+          "raw_flags": 0
+      }
+    }
+  },
+  {
+    "description": "allowed arp flag",
+    "allowed": true,
+    "request": {
+      "interface": {
+          "device": "eth0",
+          "name": "eth0",
+          "IPAddresses": [
+              {"family":0, "address":"10.244.0.14", "mask":"24"},
+              {"family":1, "address":"fe80::6474:9fff:fe6a:9601", "mask":"64"}
+          ],
+          "mtu": 1500,
+          "hwAddr": "66:74:9f:6a:96:01",
+          "pciPath": "",
+          "type_": "",
+          "raw_flags": 128
+      }
+    }
+  },
+  {
+    "description": "forbidden flag",
+    "allowed": false,
+    "request": {
+      "interface": {
+          "device": "eth0",
+          "name": "eth0",
+          "IPAddresses": [
+              {"family":0, "address":"10.244.0.14", "mask":"24"},
+              {"family":1, "address":"fe80::6474:9fff:fe6a:9601", "mask":"64"}
+          ],
+          "mtu": 1500,
+          "hwAddr": "66:74:9f:6a:96:01",
+          "pciPath": "",
+          "type_": "",
+          "raw_flags": 64
+      }
+    }
+  },
+  {
+    "description": "forbidden name",
+    "allowed": false,
+    "request": {
+      "interface": {
+          "device": "eth0",
+          "name": "lo",
+          "IPAddresses": [
+              {"family":0, "address":"10.244.0.14", "mask":"24"},
+              {"family":1, "address":"fe80::6474:9fff:fe6a:9601", "mask":"64"}
+          ],
+          "mtu": 1500,
+          "hwAddr": "66:74:9f:6a:96:01",
+          "pciPath": "",
+          "type_": "",
+          "raw_flags": 0
+      }
+    }
+  },
+  {
+    "description": "forbidden hwAddr",
+    "allowed": false,
+    "request": {
+      "interface": {
+          "device": "eth0",
+          "name": "eth0",
+          "IPAddresses": [
+              {"family":0, "address":"10.244.0.14", "mask":"24"},
+              {"family":1, "address":"fe80::6474:9fff:fe6a:9601", "mask":"64"}
+          ],
+          "mtu": 1500,
+          "hwAddr": "00:00:00:00:00:00",
+          "pciPath": "",
+          "type_": "",
+          "raw_flags": 0
+      }
+    }
+  }
+]

src/tools/genpolicy/tests/testdata/updateroutes/pod.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: dummy
+spec:
+  runtimeClassName: kata-cc-isolation
+  containers:
+  - name: dummy
+    image: registry.k8s.io/pause:3.6@sha256:3d380ca8864549e74af4b29c10f9cb0956236dfb01c40ca076fb6c37253234db

src/tools/genpolicy/tests/testdata/updateroutes/testcases.json

@@ -0,0 +1,118 @@
+[
+  {
+    "description": "compliant routes",
+    "allowed": true,
+    "request": {
+      "routes": {
+        "Routes": [
+          {
+            "dest": "",
+            "gateway": "10.244.0.1",
+            "device": "eth0",
+            "source": "",
+            "scope": 0,
+            "family": 0
+          }
+        ]
+      }
+    }
+  },
+  {
+    "description": "forbidden device",
+    "allowed": false,
+    "request": {
+      "routes": {
+        "Routes": [
+          {
+            "dest": "",
+            "gateway": "10.244.0.1",
+            "device": "lo",
+            "source": "",
+            "scope": 0,
+            "family": 0
+          }
+        ]
+      }
+    }
+  },
+  {
+    "description": "one compliant route, one noncompliant",
+    "allowed": false,
+    "request": {
+      "routes": {
+        "Routes": [
+          {
+            "dest": "",
+            "gateway": "10.244.0.1",
+            "device": "eth0",
+            "source": "",
+            "scope": 0,
+            "family": 0
+          },
+          {
+            "dest": "",
+            "gateway": "10.244.0.1",
+            "device": "eth0",
+            "source": "::1",
+            "scope": 0,
+            "family": 0
+          }
+        ]
+      }
+    }
+  },
+  {
+    "description": "noncompliant routes",
+    "allowed": false,
+    "request": {
+      "routes": {
+        "Routes": [
+          {
+            "dest": "",
+            "gateway": "10.244.0.1",
+            "device": "eth0",
+            "source": "127.0.0.1",
+            "scope": 0,
+            "family": 0
+          }
+        ]
+      }
+    }
+  },
+  {
+    "description": "noncompliant routes ipv6 1",
+    "allowed": false,
+    "request": {
+      "routes": {
+        "Routes": [
+          {
+            "dest": "",
+            "gateway": "10.244.0.1",
+            "device": "eth0",
+            "source": "::1",
+            "scope": 0,
+            "family": 0
+          }
+        ]
+      }
+    }
+  },
+  {
+    "description": "noncompliant routes ipv6 2",
+    "allowed": false,
+    "request": {
+      "routes": {
+        "Routes": [
+          {
+            "dest": "",
+            "gateway": "10.244.0.1",
+            "device": "eth0",
+            "source": "00::001",
+            "scope": 0,
+            "family": 0
+          }
+        ]
+      }
+    }
+  }
+]