Security Policy Specification for Containers

Policy Specification
Here is the specification of a security policy.
1
apiVersion: security.kubearmor.com/v1
2
kind:KubeArmorPolicy
3
metadata:
4
  name: [policy name]
5
  namespace: [namespace name]
6
​
7
spec:
8
  severity: [1-10]                         # --> optional (1 by default)
9
  tags: ["tag", ...]                       # --> optional
10
  message: [message]                       # --> optional
11
​
12
  selector:
13
    matchLabels:
14
      [key1]: [value1]
15
      [keyN]: [valueN]
16
​
17
  process:
18
    matchPaths:
19
    - path: [absolute executable path]
20
      ownerOnly: [true|false]              # --> optional
21
      fromSource:                          # --> optional
22
      - path: [absolute exectuable path]
23
    matchDirectories:
24
    - dir: [absolute directory path]
25
      recursive: [true|false]              # --> optional
26
      ownerOnly: [true|false]              # --> optional
27
      fromSource:                          # --> optional
28
      - path: [absolute exectuable path]
29
    matchPatterns:
30
    - pattern: [regex pattern]
31
      ownerOnly: [true|false]              # --> optional
32
​
33
  file:
34
    matchPaths:
35
    - path: [absolute file path]
36
      readOnly: [true|false]               # --> optional
37
      ownerOnly: [true|false]              # --> optional
38
      fromSource:                          # --> optional
39
      - path: [absolute exectuable path]
40
    matchDirectories:
41
    - dir: [absolute directory path]
42
      recursive: [true|false]              # --> optional
43
      readOnly: [true|false]               # --> optional
44
      ownerOnly: [true|false]              # --> optional
45
      fromSource:                          # --> optional
46
      - path: [absolute exectuable path]
47
    matchPatterns:
48
    - pattern: [regex pattern]
49
      readOnly: [true|false]               # --> optional
50
      ownerOnly: [true|false]              # --> optional
51
​
52
  network:
53
    matchProtocols:
54
    - protocol: [TCP|tcp|UDP|udp|ICMP|icmp]
55
      fromSource:                          # --> optional
56
      - path: [absolute exectuable path]
57
​
58
  capabilities:
59
    matchCapabilities:
60
    - capability: [capability name]
61
      fromSource:                          # --> optional
62
      - path: [absolute exectuable path]
63
​
64
  action: [Allow|Audit|Block] (Block by default)
Copied!
For better understanding, you can check the KubeArmorPolicy spec diagram.
Policy Spec Description
Now, we will briefly explain how to define a security policy.
Common
A security policy starts with the base information such as apiVersion, kind, and metadata. The apiVersion and kind would be the same in any security policies. In the case of metadata, you need to specify the names of a policy and a namespace where you want to apply the policy.
1
  apiVersion: security.kubearmor.com/v1
2
  kind:KubeArmorPolicy
3
  metadata:
4
    name: [policy name]
5
    namespace: [namespace name]
Copied!
Severity
The severity part is somewhat important. You can specify the severity of a given policy from 1 to 10. This severity will appear in alerts when policy violations happen.
1
severity: [1-10]
Copied!
Tags
The tags part is optional. You can define multiple tags (e.g., WARNING, SENSITIVE, MITRE, STIG, etc.) to categorize security policies.
1
tags: ["tag1", ..., "tagN"]
Copied!
Message
The message part is optional. You can add an alert message, and then the message will be presented in alert logs.
1
message: [message]
Copied!
Selector
The selector part is relatively straightforward. Similar to other Kubernetes configurations, you can specify (a group of) pods based on labels.
1
  selector:
2
    matchLabels:
3
      [key1]: [value1]
4
      [keyN]: [valueN]
Copied!
Process
In the process section, there are three types of matches: matchPaths, matchDirectories, and matchPatterns. You can define specific executables using matchPaths or all executables in specific directories using matchDirectories. In the case of matchPatterns, advanced operators may be able to determine particular patterns for executables by using regular expressions. However, the coverage of regular expressions is highly dependent on AppArmor (Policy Core Reference). Thus, we generally do not recommend using this match.
1
  process:
2
    matchPaths:
3
    - path: [absolute executable path]
4
      ownerOnly: [true|false]            # --> optional
5
      fromSource:                        # --> optional
6
      - path: [absolute executable path]
7
    matchDirectories:
8
    - dir: [absolute directory path]
9
      recursive: [true|false]            # --> optional
10
      ownerOnly: [true|false]            # --> optional
11
      fromSource:                        # --> optional
12
      - path: [absolute exectuable path]
13
    matchPatterns:
14
    - pattern: [regex pattern]
15
      ownerOnly: [true|false]            # --> optional
Copied!
In each match, there are three options.
ownerOnly (static action: allow owner only; otherwise block all)
If this is enabled, the owners of the executable(s) defined with matchPaths and matchDirectories will be only allowed to execute.
recursive
If this is enabled, the coverage will extend to the subdirectories of the directory defined with matchDirectories.
fromSource
If a path is specified in fromSource, the executable at the path will be allowed/blocked to execute the executables defined with matchPaths or matchDirectories. For better understanding, let us say that an operator defines a policy as follows. Then, /bin/bash will be only allowed (blocked) to execute /bin/sleep. Otherwise, the execution of /bin/sleep will be blocked (allowed).
1
  process:
2
    matchPaths:
3
    - path: /bin/sleep
4
      fromSource:
5
      - path: /bin/bash
Copied!
File
The file section is quite similar to the process section.
1
  file:
2
    matchPaths:
3
    - path: [absolute file path]
4
      readOnly: [true|false]             # --> optional
5
      ownerOnly: [true|false]            # --> optional
6
      fromSource:                        # --> optional
7
      - path: [absolute file path]
8
    matchDirectories:
9
    - dir: [absolute directory path]
10
      recursive: [true|false]            # --> optional
11
      readOnly: [true|false]             # --> optional
12
      ownerOnly: [true|false]            # --> optional
13
      fromSource:                        # --> optional
14
      - path: [absolute file path]
15
    matchPatterns:
16
    - pattern: [regex pattern]
17
      readOnly: [true|false]             # --> optional
18
      ownerOnly: [true|false]            # --> optional
Copied!
The only difference between 'process' and 'file' is the readOnly option.
readOnly (static action: allow to read only; otherwise block all)
If this is enabled, the read operation will be only allowed, and any other operations (e.g., write) will be blocked.
Network
In the case of network, there is currently one match type: matchProtocols. You can define specific protocols among TCP, UDP, and ICMP.
1
  network:
2
    matchProtocols:
3
    - protocol: [protocol]               # --> [ TCP | tcp | UDP | udp | ICMP | icmp ]
4
      fromSource:                        # --> optional
5
      - path: [absolute file path]
Copied!
Capabilities
In the case of capabilities, there is currently one match type: matchCapabilities. You can define specific capability names to allow or block using matchCapabilities. You can check available capabilities in Capability List.
1
  capabilities:
2
    matchCapabilities:
3
    - capability: [capability name]
4
      fromSource:                        # --> optional
5
      - path: [absolute file path]
Copied!
Action
The action could be Allow, Audit, or Block. Security policies would be handled in a blacklist manner or a whitelist manner according to the action. Thus, you need to define the action carefully. You can refer to Consideration in Policy Action for more details. In the case of the Audit action, we can use this action for policy verification before applying a security policy with the Block action.
1
  action: [Allow|Audit|Block]
Copied!
Getting Started - Previous
Deployment Guide
Next - Getting Started
Security Policy Examples for Containers
Last modified 2mo ago
Export as PDF
Copy link
Contents
Policy Specification
Policy Spec Description