Merge pull request #140 from microsoft/danmihai1/hooks

genpolicy: reject create custom hook settings
microsoft · Jan 6, 2024 · 7da3655 · 7da3655
2 parents cb8b47c + c7e219b
commit 7da3655
Show file tree

Hide file tree

Showing 59 changed files with 72 additions and 59 deletions.
diff --git a/src/agent/samples/policy/yaml/configmap/pod-cm1.yaml b/src/agent/samples/policy/yaml/configmap/pod-cm1.yaml
diff --git a/src/agent/samples/policy/yaml/configmap/pod-cm2.yaml b/src/agent/samples/policy/yaml/configmap/pod-cm2.yaml
diff --git a/src/agent/samples/policy/yaml/deployment/deployment-azure-vote-back.yaml b/src/agent/samples/policy/yaml/deployment/deployment-azure-vote-back.yaml
diff --git a/src/agent/samples/policy/yaml/deployment/deployment-azure-vote-front.yaml b/src/agent/samples/policy/yaml/deployment/deployment-azure-vote-front.yaml
diff --git a/src/agent/samples/policy/yaml/deployment/deployment-busybox.yaml b/src/agent/samples/policy/yaml/deployment/deployment-busybox.yaml
diff --git a/src/agent/samples/policy/yaml/deployment/deployment-docker-busybox.yaml b/src/agent/samples/policy/yaml/deployment/deployment-docker-busybox.yaml
diff --git a/src/agent/samples/policy/yaml/job/test-job.yaml b/src/agent/samples/policy/yaml/job/test-job.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/conformance/conformance-e2e.yaml b/src/agent/samples/policy/yaml/kubernetes/conformance/conformance-e2e.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/conformance/csi-hostpath-plugin.yaml b/src/agent/samples/policy/yaml/kubernetes/conformance/csi-hostpath-plugin.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/conformance/csi-hostpath-testing.yaml b/src/agent/samples/policy/yaml/kubernetes/conformance/csi-hostpath-testing.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/conformance/etcd-statefulset.yaml b/src/agent/samples/policy/yaml/kubernetes/conformance/etcd-statefulset.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/conformance/hello-populator-deploy.yaml b/src/agent/samples/policy/yaml/kubernetes/conformance/hello-populator-deploy.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/conformance/netexecrc.yaml b/src/agent/samples/policy/yaml/kubernetes/conformance/netexecrc.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/conformance2/ingress-http-rc.yaml b/src/agent/samples/policy/yaml/kubernetes/conformance2/ingress-http-rc.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/conformance2/ingress-http2-rc.yaml b/src/agent/samples/policy/yaml/kubernetes/conformance2/ingress-http2-rc.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/conformance2/ingress-multiple-certs-rc.yaml b/src/agent/samples/policy/yaml/kubernetes/conformance2/ingress-multiple-certs-rc.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/conformance2/ingress-nginx-rc.yaml b/src/agent/samples/policy/yaml/kubernetes/conformance2/ingress-nginx-rc.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/conformance2/ingress-static-ip-rc.yaml b/src/agent/samples/policy/yaml/kubernetes/conformance2/ingress-static-ip-rc.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/fixtures/appsv1deployment.yaml b/src/agent/samples/policy/yaml/kubernetes/fixtures/appsv1deployment.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/fixtures/daemon.yaml b/src/agent/samples/policy/yaml/kubernetes/fixtures/daemon.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/fixtures/deploy-clientside.yaml b/src/agent/samples/policy/yaml/kubernetes/fixtures/deploy-clientside.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/fixtures/job.yaml b/src/agent/samples/policy/yaml/kubernetes/fixtures/job.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/fixtures/multi-resource-yaml.yaml b/src/agent/samples/policy/yaml/kubernetes/fixtures/multi-resource-yaml.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/fixtures/rc-lastapplied.yaml b/src/agent/samples/policy/yaml/kubernetes/fixtures/rc-lastapplied.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/fixtures/rc-noexist.yaml b/src/agent/samples/policy/yaml/kubernetes/fixtures/rc-noexist.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/fixtures/replication.yaml b/src/agent/samples/policy/yaml/kubernetes/fixtures/replication.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/fixtures2/rc-service.yaml b/src/agent/samples/policy/yaml/kubernetes/fixtures2/rc-service.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/fixtures2/valid-pod.yaml b/src/agent/samples/policy/yaml/kubernetes/fixtures2/valid-pod.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/incomplete-init/cassandra-statefulset.yaml b/src/agent/samples/policy/yaml/kubernetes/incomplete-init/cassandra-statefulset.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/incomplete-init/cockroachdb-statefulset.yaml b/src/agent/samples/policy/yaml/kubernetes/incomplete-init/cockroachdb-statefulset.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/incomplete-init/controller.yaml b/src/agent/samples/policy/yaml/kubernetes/incomplete-init/controller.yaml
diff --git a/src/agent/samples/policy/yaml/kubernetes/incomplete-init/node_ds.yaml b/src/agent/samples/policy/yaml/kubernetes/incomplete-init/node_ds.yaml
diff --git a/src/agent/samples/policy/yaml/pod/pod-exec.yaml b/src/agent/samples/policy/yaml/pod/pod-exec.yaml
diff --git a/src/agent/samples/policy/yaml/pod/pod-lifecycle.yaml b/src/agent/samples/policy/yaml/pod/pod-lifecycle.yaml
diff --git a/src/agent/samples/policy/yaml/pod/pod-one-container.yaml b/src/agent/samples/policy/yaml/pod/pod-one-container.yaml
diff --git a/src/agent/samples/policy/yaml/pod/pod-persistent-volumes.yaml b/src/agent/samples/policy/yaml/pod/pod-persistent-volumes.yaml
diff --git a/src/agent/samples/policy/yaml/pod/pod-same-containers.yaml b/src/agent/samples/policy/yaml/pod/pod-same-containers.yaml
diff --git a/src/agent/samples/policy/yaml/pod/pod-spark.yaml b/src/agent/samples/policy/yaml/pod/pod-spark.yaml
diff --git a/src/agent/samples/policy/yaml/pod/pod-three-containers.yaml b/src/agent/samples/policy/yaml/pod/pod-three-containers.yaml
diff --git a/src/agent/samples/policy/yaml/pod/pod-ubuntu.yaml b/src/agent/samples/policy/yaml/pod/pod-ubuntu.yaml
diff --git a/src/agent/samples/policy/yaml/replica-set/replica-busy.yaml b/src/agent/samples/policy/yaml/replica-set/replica-busy.yaml
diff --git a/src/agent/samples/policy/yaml/secrets/azure-file-secrets.yaml b/src/agent/samples/policy/yaml/secrets/azure-file-secrets.yaml
diff --git a/src/agent/samples/policy/yaml/stateful-set/web.yaml b/src/agent/samples/policy/yaml/stateful-set/web.yaml
diff --git a/src/agent/samples/policy/yaml/webhook/webhook-pod1.yaml b/src/agent/samples/policy/yaml/webhook/webhook-pod1.yaml
diff --git a/src/agent/samples/policy/yaml/webhook/webhook-pod2.yaml b/src/agent/samples/policy/yaml/webhook/webhook-pod2.yaml
diff --git a/src/agent/samples/policy/yaml/webhook/webhook-pod3.yaml b/src/agent/samples/policy/yaml/webhook/webhook-pod3.yaml
diff --git a/src/agent/samples/policy/yaml/webhook/webhook-pod4.yaml b/src/agent/samples/policy/yaml/webhook/webhook-pod4.yaml
diff --git a/src/agent/samples/policy/yaml/webhook/webhook-pod5.yaml b/src/agent/samples/policy/yaml/webhook/webhook-pod5.yaml
diff --git a/src/agent/samples/policy/yaml/webhook/webhook-pod6.yaml b/src/agent/samples/policy/yaml/webhook/webhook-pod6.yaml
diff --git a/src/agent/samples/policy/yaml/webhook/webhook-pod7.yaml b/src/agent/samples/policy/yaml/webhook/webhook-pod7.yaml
diff --git a/src/agent/samples/policy/yaml/webhook2/webhook-pod10.yaml b/src/agent/samples/policy/yaml/webhook2/webhook-pod10.yaml
diff --git a/src/agent/samples/policy/yaml/webhook2/webhook-pod11.yaml b/src/agent/samples/policy/yaml/webhook2/webhook-pod11.yaml
diff --git a/src/agent/samples/policy/yaml/webhook2/webhook-pod12.yaml b/src/agent/samples/policy/yaml/webhook2/webhook-pod12.yaml
diff --git a/src/agent/samples/policy/yaml/webhook2/webhook-pod13.yaml b/src/agent/samples/policy/yaml/webhook2/webhook-pod13.yaml
diff --git a/src/agent/samples/policy/yaml/webhook2/webhook-pod8.yaml b/src/agent/samples/policy/yaml/webhook2/webhook-pod8.yaml
diff --git a/src/agent/samples/policy/yaml/webhook2/webhook-pod9.yaml b/src/agent/samples/policy/yaml/webhook2/webhook-pod9.yaml
diff --git a/src/agent/samples/policy/yaml/webhook3/dns-test.yaml b/src/agent/samples/policy/yaml/webhook3/dns-test.yaml
diff --git a/src/agent/samples/policy/yaml/webhook3/many-layers.yaml b/src/agent/samples/policy/yaml/webhook3/many-layers.yaml
diff --git a/src/tools/genpolicy/rules.rego b/src/tools/genpolicy/rules.rego
@@ -38,6 +38,9 @@ CreateContainerRequest {
     i_oci := input.OCI
     i_storages := input.storages
 
+    print("CreateContainerRequest: i_oci.Hooks =", i_oci.Hooks)
+    is_null(i_oci.Hooks)
+
     some p_container in policy_data.containers
     print("======== CreateContainerRequest: trying next policy container")
 
@@ -1117,6 +1120,9 @@ CopyFileRequest {
 }
 
 CreateSandboxRequest {
+    print("CreateSandboxRequest: input.guest_hook_path =", input.guest_hook_path)
+    count(input.guest_hook_path) == 0
+
     print("CreateSandboxRequest: input.kernel_modules =", input.kernel_modules)
     count(input.kernel_modules) == 0