filters: implement capability filters #2107
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
✅ Deploy Preview for tetragon ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
willfindlay
force-pushed
the
pr/willfindlay/cap-filter
branch
from
0f840bb to
64c51d9
Compare
willfindlay
added
the
release-note/major
willfindlay
force-pushed
the
pr/willfindlay/cap-filter
branch
3 times, most recently
from
553da6a to
b7fe320
Compare
|
Marking as draft while I debug |
willfindlay
force-pushed
the
pr/willfindlay/cap-filter
branch
2 times, most recently
from
8be773c to
ff69e2b
Compare
Implement a new export filter for process capabilities. The filter includes support for matching effective, permitted, and inheritable capability sets, with various match behaviours. Behaviours include:
- `any`: matches if one or more listed capabilities appear in process caps
- `all`: matches if all listed capabilities appear in process caps
- `exactly`: matches if listed capabilities are exactly equal to process caps
- `none`: matches if no listed capabilities are in process caps
The following are some example uses.
Match when effective capabilities include either CAP_SYS_ADMIN or CAP_BPF:
{"capabilities": {"effective": {"any": ["CAP_SYS_ADMIN", "CAP_BPF"]}}}
Match when permitted capabilities do not include CAP_SYS_ADMIN:
{"capabilities": {"permitted": {"none": ["CAP_SYS_ADMIN", "CAP_BPF"]}}}
Match when inheritable capabilities include either CAP_SYS_ADMIN and CAP_BPF:
{"capabilities": {"inheritable": {"all": ["CAP_SYS_ADMIN", "CAP_BPF"]}}}
Match when inheritable capabilities are exactly CAP_SYS_ADMIN:
{"capabilities": {"inheritable": {"exactly": ["CAP_SYS_ADMIN"]}}}
Signed-off-by: William Findlay <will@isovalent.com>
We added a few new modules with their own vendor directories, but the go-format target was outdated such that it wasn't igoring them. Fix this by simply updating it to ignore all `vendor/*` directories regardless of their parent path. Signed-off-by: William Findlay <will@isovalent.com>
willfindlay
force-pushed
the
pr/willfindlay/cap-filter
branch
from
ff69e2b to
d07df31
Compare
jrfastab
approved these changes
Feb 29, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Implement a new export filter for process capabilities. The filter includes support for matching effective, permitted, and inheritable capability sets, with various match behaviours. Behaviours include:
any: matches if one or more listed capabilities appear in process capsall: matches if all listed capabilities appear in process capsexactly: matches if listed capabilities are exactly equal to process capsnone: matches if no listed capabilities are in process capsThe following are some example uses.
Match when effective capabilities include either CAP_SYS_ADMIN or CAP_BPF:
Match when permitted capabilities do not include CAP_SYS_ADMIN:
Match when inheritable capabilities include either CAP_SYS_ADMIN and CAP_BPF:
Match when inheritable capabilities are exactly CAP_SYS_ADMIN: