d9af8205c0
This patch place in a sample for an init container, generated by helm toolkit, to load an apparmor profile included in the chart. Change-Id: I309e3b550fd1d683745c319aa39bcfb96b77ea14 Signed-off-by: Tin Lam <tin@irrational.io>
141 lines
4.4 KiB
Bash
Executable File
141 lines
4.4 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# Copyright 2017 The Openstack-Helm Authors.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
# not use this file except in compliance with the License. You may obtain
|
|
# a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
# License for the specific language governing permissions and limitations
|
|
# under the License.
|
|
|
|
set -xe
|
|
|
|
namespace="osh-infra"
|
|
|
|
# NOTE: Lint and package chart
|
|
make memcached
|
|
|
|
tee /tmp/memcached.yaml <<EOF
|
|
images:
|
|
tags:
|
|
apparmor_loader: google/apparmor-loader:latest
|
|
pod:
|
|
mandatory_access_control:
|
|
type: apparmor
|
|
configmap_apparmor: true
|
|
memcached:
|
|
memcached: localhost/my-apparmor-v1
|
|
apparmor-loader: unconfined
|
|
conf:
|
|
apparmor_profiles:
|
|
my-apparmor-v1.profile: |-
|
|
#include <tunables/global>
|
|
profile my-apparmor-v1 flags=(attach_disconnected,mediate_deleted) {
|
|
#include <abstractions/base>
|
|
network inet tcp,
|
|
network inet udp,
|
|
network inet icmp,
|
|
deny network raw,
|
|
deny network packet,
|
|
file,
|
|
umount,
|
|
deny /bin/** wl,
|
|
deny /boot/** wl,
|
|
deny /dev/** wl,
|
|
deny /etc/** wl,
|
|
deny /home/** wl,
|
|
deny /lib/** wl,
|
|
deny /lib64/** wl,
|
|
deny /media/** wl,
|
|
deny /mnt/** wl,
|
|
deny /opt/** wl,
|
|
deny /proc/** wl,
|
|
deny /root/** wl,
|
|
deny /sbin/** wl,
|
|
deny /srv/** wl,
|
|
deny /tmp/** wl,
|
|
deny /sys/** wl,
|
|
deny /usr/** wl,
|
|
audit /** w,
|
|
/var/run/nginx.pid w,
|
|
/usr/sbin/nginx ix,
|
|
deny /bin/dash mrwklx,
|
|
deny /bin/sh mrwklx,
|
|
deny /usr/bin/top mrwklx,
|
|
capability chown,
|
|
capability dac_override,
|
|
capability setuid,
|
|
capability setgid,
|
|
capability net_bind_service,
|
|
deny @{PROC}/{*,**^[0-9*],sys/kernel/shm*} wkx,
|
|
deny @{PROC}/sysrq-trigger rwklx,
|
|
deny @{PROC}/mem rwklx,
|
|
deny @{PROC}/kmem rwklx,
|
|
deny @{PROC}/kcore rwklx,
|
|
deny mount,
|
|
deny /sys/[^f]*/** wklx,
|
|
deny /sys/f[^s]*/** wklx,
|
|
deny /sys/fs/[^c]*/** wklx,
|
|
deny /sys/fs/c[^g]*/** wklx,
|
|
deny /sys/fs/cg[^r]*/** wklx,
|
|
deny /sys/firmware/efi/efivars/** rwklx,
|
|
deny /sys/kernel/security/** rwklx,
|
|
}
|
|
EOF
|
|
|
|
# NOTE: Deploy command
|
|
: ${OSH_INFRA_EXTRA_HELM_ARGS:=""}
|
|
helm upgrade --install memcached ./memcached \
|
|
--namespace=$namespace \
|
|
--set pod.replicas.server=1 \
|
|
--values=/tmp/memcached.yaml \
|
|
${OSH_INFRA_EXTRA_HELM_ARGS} \
|
|
${OSH_INFRA_EXTRA_HELM_ARGS_MEMCACHED}
|
|
|
|
# NOTE: Wait for deploy
|
|
./tools/deployment/common/wait-for-pods.sh $namespace
|
|
|
|
# NOTE: Validate Deployment info
|
|
helm status memcached
|
|
|
|
# Run a test. Note: the simple "cat /proc/1/attr/current" verification method
|
|
# will not work, as memcached has multiple processes running, so we have to
|
|
# find out which one is the memcached application process.
|
|
pod=$(kubectl -n $namespace get pod | grep memcached | awk '{print $1}')
|
|
unsorted_process_file="/tmp/unsorted_proc_list"
|
|
sorted_process_file="/tmp/proc_list"
|
|
expected_profile="my-apparmor-v1 (enforce)"
|
|
|
|
# Grab the processes (numbered directories) from the /proc directory,
|
|
# and then sort them. Highest proc number indicates most recent process.
|
|
kubectl -n $namespace exec $pod -- ls -1 /proc | grep -e "^[0-9]*$" > $unsorted_process_file
|
|
sort --numeric-sort $unsorted_process_file > $sorted_process_file
|
|
|
|
# The last/latest process in the list will actually be the "ls" command above,
|
|
# which isn't running any more, so remove it.
|
|
sed -i '$ d' $sorted_process_file
|
|
|
|
while IFS='' read -r process || [[ -n "$process" ]]; do
|
|
echo "Process ID: $process"
|
|
proc_name=`kubectl -n $namespace exec $pod -- cat /proc/$process/status | grep "Name:" | awk -F' ' '{print $2}'`
|
|
echo "Process Name: $proc_name"
|
|
profile=`kubectl -n $namespace exec $pod -- cat /proc/$process/attr/current`
|
|
echo "Profile running: $profile"
|
|
if test "$profile" != "$expected_profile"
|
|
then
|
|
if test "$proc_name" == "pause"
|
|
then
|
|
echo "Root process (pause) can run docker-default, it's ok."
|
|
else
|
|
echo "$profile is the WRONG PROFILE!!"
|
|
return 1
|
|
fi
|
|
fi
|
|
done < $sorted_process_file
|