genpolicy: Support fsGroup

src/tools/genpolicy/Cargo.toml

@@ -21,6 +21,7 @@ clap = { version = "4.1.8", features = ["derive"] }
 # YAML file serialization/deserialization.
 base64 = "0.21.0"
 serde = { version = "1.0.159", features = ["derive"] }
+serde_repr = "0.1"
 
 # Newer serde_yaml versions are using unsafe-libyaml instead of yaml-rust,
 # and incorrectly change on serialization:

src/tools/genpolicy/src/agent.rs

@@ -1,4 +1,5 @@
 use serde::{Deserialize, Serialize};
+use serde_repr::*;
 
 #[derive(Clone, Debug, Serialize, Deserialize)]
 pub struct Storage {
@@ -8,11 +9,19 @@ pub struct Storage {
     pub fstype: String,
     pub options: Vec<String>,
     pub mount_point: String,
-    pub fs_group: Option<SerializedFsGroup>,
+    pub fs_group: Option<FSGroup>,
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize)]
-pub struct SerializedFsGroup {
-    pub group_id: u32,
-    pub group_change_policy: u32,
+pub struct FSGroup {
+    pub group_id: i64,
+    pub group_change_policy: FSGroupChangePolicy,
+}
+
+#[derive(Clone, Debug, Default, Serialize_repr, Deserialize_repr)]
+#[repr(u8)]
+pub enum FSGroupChangePolicy {
+    #[default]
+    Always = 0,
+    OnRootMismatch = 1,
 }

src/tools/genpolicy/src/cronjob.rs

@@ -104,6 +104,7 @@ impl yaml::K8sResource for CronJob {
                 container,
                 settings,
                 volumes,
+                None,
             );
         }
     }

src/tools/genpolicy/src/daemon_set.rs

@@ -106,6 +106,7 @@ impl yaml::K8sResource for DaemonSet {
                 container,
                 settings,
                 volumes,
+                None,
             )
         }
     }

src/tools/genpolicy/src/deployment.rs

@@ -104,6 +104,7 @@ impl yaml::K8sResource for Deployment {
                 container,
                 settings,
                 volumes,
+                None,
             );
         }
     }

src/tools/genpolicy/src/job.rs

@@ -78,6 +78,7 @@ impl yaml::K8sResource for Job {
                 container,
                 settings,
                 volumes,
+                None,
             );
         }
     }

src/tools/genpolicy/src/mount_and_storage.rs

@@ -141,6 +141,7 @@ pub fn get_mount_and_storage(
     persistent_volume_claims: &[pvc::PersistentVolumeClaim],
     yaml_volume: &volume::Volume,
     yaml_mount: &pod::VolumeMount,
+    pod_fs_group: Option<i64>,
 ) {
     let propagation = match &yaml_mount.mountPropagation {
         Some(p) if p == "Bidirectional" => "rshared",
@@ -171,6 +172,7 @@ pub fn get_mount_and_storage(
             storages,
             persistent_volume_claims,
             mount_options,
+            pod_fs_group,
         );
     } else if yaml_volume.azureFile.is_some() {
         get_shared_bind_mount(yaml_mount, p_mounts, mount_options);
@@ -191,6 +193,7 @@ pub fn get_mount_and_storage(
             p_mounts,
             storages,
             mount_options,
+            pod_fs_group,
         );
     } else {
         todo!("Unsupported volume type {:?}", yaml_volume);
@@ -258,6 +261,7 @@ fn get_persistent_volume_claim_mount(
     storages: &mut Vec<agent::Storage>,
     persistent_volume_claims: &[pvc::PersistentVolumeClaim],
     mount_options: (&str, &str),
+    pod_fs_group: Option<i64>,
 ) {
     let volume_pvc = yaml_volume.persistentVolumeClaim.as_ref().unwrap();
     let pvc_name = &volume_pvc.claimName;
@@ -292,6 +296,7 @@ fn get_persistent_volume_claim_mount(
         storages,
         mount_options,
         smb_mount_options,
+        pod_fs_group,
     );
 }
 
@@ -457,6 +462,7 @@ fn get_ephemeral_mount(
     p_mounts: &mut Vec<policy::KataMount>,
     storages: &mut Vec<agent::Storage>,
     mount_options: (&str, &str),
+    pod_fs_group: Option<i64>,
 ) {
     let storage_class = yaml_volume
         .ephemeral
@@ -477,6 +483,7 @@ fn get_ephemeral_mount(
         storages,
         mount_options,
         smb_mount_options,
+        pod_fs_group,
     );
 }
 
@@ -487,19 +494,29 @@ pub fn handle_persistent_volume_claim(
     p_mounts: &mut Vec<policy::KataMount>,
     storages: &mut Vec<agent::Storage>,
     mount_options: (&str, &str),
-    smb_mount_options: Option<Vec<String>>, // Pass SMB mount options
+    smb_mount_options: Option<Vec<String>>,
+    pod_fs_group: Option<i64>,
 ) {
     if is_blk_mount || is_smb_mount {
         let source = "$(spath)/$(b64-direct-vol-path)".to_string();
 
+        let fs_group = if is_blk_mount {
+            pod_fs_group.map(|group_id| agent::FSGroup {
+                group_id,
+                group_change_policy: Default::default(),
+            })
+        } else {
+            None
+        };
+
         storages.push(agent::Storage {
             driver: if is_blk_mount {
                 "blk".to_string()
             } else {
                 "smb".to_string()
             },
             driver_options: Vec::new(),
-            fs_group: None,
+            fs_group: fs_group,
             source: "$(direct-vol-path)".to_string(),
             mount_point: source.to_string(),
             fstype: "$(fs-type)".to_string(),

src/tools/genpolicy/src/pod.rs

@@ -294,6 +294,9 @@ struct SecurityContext {
     #[serde(skip_serializing_if = "Option::is_none")]
     runAsUser: Option<i64>,
 
+    #[serde(skip_serializing_if = "Option::is_none")]
+    fsGroup: Option<i64>,
+
     #[serde(skip_serializing_if = "Option::is_none")]
     seccompProfile: Option<SeccompProfile>,
 }
@@ -313,6 +316,9 @@ struct SeccompProfile {
 pub struct PodSecurityContext {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub runAsUser: Option<i64>,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub fsGroup: Option<i64>,
     // TODO: additional fields.
 }
 
@@ -844,6 +850,7 @@ impl yaml::K8sResource for Pod {
                 container,
                 settings,
                 volumes,
+                self.spec.securityContext.as_ref().and_then(|sctx| sctx.fsGroup),
             );
         }
     }
@@ -935,6 +942,9 @@ impl Container {
             if let Some(uid) = context.runAsUser {
                 process.User.UID = uid.try_into().unwrap();
             }
+            if let Some(group_id) = context.fsGroup {
+                process.User.AdditionalGids.push(group_id.try_into().unwrap());
+            }
             if let Some(allow) = context.allowPrivilegeEscalation {
                 process.NoNewPrivileges = !allow
             }
@@ -983,6 +993,7 @@ pub async fn add_pause_container(containers: &mut Vec<Container>, config: &Confi
             privileged: None,
             capabilities: None,
             runAsUser: None,
+            fsGroup: None,
             seccompProfile: None,
         }),
         ..Default::default()

src/tools/genpolicy/src/replica_set.rs

@@ -76,6 +76,7 @@ impl yaml::K8sResource for ReplicaSet {
                 container,
                 settings,
                 volumes,
+                None,
             );
         }
     }

src/tools/genpolicy/src/replication_controller.rs

@@ -78,6 +78,7 @@ impl yaml::K8sResource for ReplicationController {
                 container,
                 settings,
                 volumes,
+                None,
             );
         }
     }

src/tools/genpolicy/src/stateful_set.rs

@@ -126,6 +126,7 @@ impl yaml::K8sResource for StatefulSet {
                 container,
                 settings,
                 volumes,
+                None,
             );
         }
 
@@ -156,6 +157,7 @@ impl yaml::K8sResource for StatefulSet {
                     settings,
                     volume_mounts,
                     claims,
+                    None,
                 );
             }
         }
@@ -206,6 +208,7 @@ impl StatefulSet {
         settings: &settings::Settings,
         volume_mounts: &Vec<pod::VolumeMount>,
         claims: &[pvc::PersistentVolumeClaim],
+        pod_fs_group: Option<i64>,
     ) {
         debug!("StatefulSet::get_mounts_and_storages");
         for mount in volume_mounts {
@@ -236,6 +239,7 @@ impl StatefulSet {
                             storages,
                             mount_options,
                             smb_mount_options,
+                            pod_fs_group,
                         );
                     }
                 }

src/tools/genpolicy/src/yaml.rs

@@ -257,6 +257,7 @@ pub fn get_container_mounts_and_storages(
     container: &pod::Container,
     settings: &settings::Settings,
     volumes: &Vec<volume::Volume>,
+    pod_fs_group: Option<i64>,
 ) {
     if let Some(volume_mounts) = &container.volumeMounts {
         for volume in volumes {
@@ -269,6 +270,7 @@ pub fn get_container_mounts_and_storages(
                         persistent_volume_claims,
                         volume,
                         volume_mount,
+                        pod_fs_group,
                     );
                 }
             }
@@ -348,5 +350,8 @@ pub fn get_process_fields(
         if let Some(uid) = context.runAsUser {
             process.User.UID = uid.try_into().unwrap();
         }
+        if let Some(group_id) = context.fsGroup {
+            process.User.AdditionalGids.push(group_id.try_into().unwrap());
+        }
     }
 }