Apparmor allow based policies not working as expected.

[achrefbensaad]

Description

apiVersion: security.kubearmor.com/v1
kind: KubeArmorPolicy
metadata:
  name: autopol-system-1080768273
  namespace: default
spec:
  action: Allow
  file:
    matchDirectories:
    - dir: /
      fromSource:
      - path: /bin/bash
      recursive: true
    - dir: /etc/
      fromSource:
      - path: /bin/cat
      recursive: true
  process:
    matchPaths:
    - path: /bin/bash
    - path: /bin/cat
  selector:
    matchLabels:
      app: default
  severity: 1

Applying the following yaml policy should allow us to:

• run bash without seeing any error messages
• cat will get access only to /etc/**

Acutual behavior

• Bash is working as expteced
• Executing cat command, yeilds a permission denied error.

Proposed behavior for AppArmor allow based policies

We will be using apparmor domain transitions to enforce prolicies for each binary.

White listed processes

For white listed processes we are going to enforce the following rules:

• If a process is allowed but no file access is granted, we will allow the process to run but no file/dir access is granted.

apiVersion: security.kubearmor.com/v1
kind: KubeArmorPolicy
metadata:
  name: autopol-system-xxxxxxx
  namespace: default
spec:
  action: Allow
  process:
    matchPaths:
    - path: /bin/bash
    - path: /bin/cat
  selector:
    matchLabels:
      app: default
  severity: 1

The above policy should generate the following psedo-apparmor profile

## == Managed by KubeArmor == ##

#include <tunables/global>

profile kubearmor-default-deploy01-c1 flags=(attach_disconnected,mediate_deleted) {
	#include <abstractions/base>

	network,
	capability,

	/bin/bash px -> kubearmor-default-deploy01-c1-XXXXX-bash,
    /bin/cat px -> kubearmor-default-deploy01-c1-XXXXX-cat,
}

profile kubearmor-default-deploy01-c1-XXXXX-bash flags=(attach_disconnected,mediate_deleted) {
}

profile kubearmor-default-deploy01-c1-XXXXX-cat flags=(attach_disconnected,mediate_deleted) {
}

• If from source is used to whitelist, a perticular process. The whitelisted process shoud NOT inherit access from the parent process.

apiVersion: security.kubearmor.com/v1
kind: KubeArmorPolicy
metadata:
  name: autopol-system-xxxxxxx
  namespace: default
spec:
  action: Allow
  process:
    matchPaths:
    - path: /bin/cat
      fromSource:
      - path: /bin/bash
    - path: /bin/bash
  selector:
    matchLabels:
      app: default
  severity: 1

The above policy should generate the following psedo-apparmor profile

## == Managed by KubeArmor == ##

#include <tunables/global>

profile kubearmor-default-deploy01-c1 flags=(attach_disconnected,mediate_deleted) {
	#include <abstractions/base>

	network,
	capability,

	/bin/bash px -> kubearmor-default-deploy01-c1-XXXXX-bash,
}

profile kubearmor-default-deploy01-c1-XXXXX-bash flags=(attach_disconnected,mediate_deleted) {
    /bin/cat px -> kubearmor-default-deploy01-c1-XXXXX-cat,
}

profile kubearmor-default-deploy01-c1-XXXXX-cat flags=(attach_disconnected,mediate_deleted) {
}

bash should be explicitly defined in the whitelisted processes, else cat will never be able to run.