Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix Issue #28 #29

Closed
wants to merge 26 commits into from
Closed

Fix Issue #28 #29

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
26 commits
Select commit Hold shift + click to select a range
a53f1d0
feat: Add a cleanup script that can delete all resources (running the…
b0m313 Jan 5, 2024
4407548
fix:: Resolve an issue with deleting SIBs
b0m313 Jan 5, 2024
76b7bc4
style(cleanup): Add license
b0m313 Jan 5, 2024
36ef54d
Move script file
seungsoo-lee Jan 6, 2024
61e72cc
Deleted files
seungsoo-lee Jan 6, 2024
e4fc074
feat(api): Add syscalls-related field
b0m313 Jan 9, 2024
08e52bd
feat(config): Add syscalls-related fields
b0m313 Jan 9, 2024
0f699de
feat: Add go.work to use two mods
b0m313 Jan 9, 2024
bb10d04
feat(config): Add the adapter's config
b0m313 Jan 9, 2024
e4e5d07
feat(receiver): Add a receiver for the adapter
b0m313 Jan 9, 2024
2f38ca1
feat(core): Add a transformer and Applier for the adapter
b0m313 Jan 9, 2024
665ec93
feat(adapter): Add adapter-specific main.go and other files
b0m313 Jan 9, 2024
169e905
feat(adapter): Add core(converter, enforcer)
b0m313 Jan 9, 2024
7a73ed2
feat(adapter): Add applier and modify package name
b0m313 Jan 9, 2024
5cab7e0
featgo.mod): go version to use go.work (requires go >= 1.21)
b0m313 Jan 9, 2024
7027dd1
feat(applier): Add license
b0m313 Jan 9, 2024
c692c1e
feat(receiver): Add karmor policy delete
b0m313 Jan 9, 2024
af70371
test(v2): Modify ID
b0m313 Jan 9, 2024
67a4fa2
Docs: Update Tutorials
b0m313 Jan 9, 2024
a241d69
fix(go.mod): Resolve lint
b0m313 Jan 9, 2024
f7ea821
fix(gomod): resolve golangci-lint
b0m313 Jan 9, 2024
8a5432a
Update Quick-tutorials.md
seungsoo-lee Jan 9, 2024
2805557
Update nimbus-adapter
b0m313 Jan 9, 2024
8d34372
Delete core directory
b0m313 Jan 9, 2024
a3633ee
fix(adapter): Modify path (main.go)
b0m313 Jan 9, 2024
6a603cf
Update nimbus adapter
seungsoo-lee Jan 9, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
*.dylib
bin
Dockerfile.cross
nimbus-kubearmor

# Test binary, build with `go test -c`
*.test
Expand Down
23 changes: 19 additions & 4 deletions api/v1/nimbuspolicy_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ type Rule struct {
MatchProtocols []MatchProtocol `json:"matchProtocols,omitempty"`

// Process: MatchPaths, MatchDirectories, MatchPatterns
// File: MatchPaths, MatchDirectories
// File: MatchPaths, MatchDirectories, MatchPatterns
MatchPaths []MatchPath `json:"matchPaths,omitempty"`
MatchDirectories []MatchDirectory `json:"matchDirectories,omitempty"`
MatchPatterns []MatchPattern `json:"matchPatterns,omitempty"`
Expand All @@ -52,7 +52,8 @@ type Rule struct {
MatchCapabilities []MatchCapability `json:"matchCapabilities,omitempty"`

// Syscalls: MatchSyscalls
MatchSyscalls []MatchSyscall `json:"matchSyscalls,omitempty"`
MatchSyscalls []MatchSyscall `json:"matchSyscalls,omitempty"`
MatchSyscallPaths []MatchSyscallPath `json:"matchSyscallPaths,omitempty"`

FromCIDRSet []CIDRSet `json:"fromCIDRSet,omitempty"`
ToPorts []ToPort `json:"toPorts,omitempty"`
Expand Down Expand Up @@ -97,12 +98,26 @@ type MatchPattern struct {

// MatchSyscall defines a syscall for syscall policies
type MatchSyscall struct {
Syscalls []string `json:"syscalls,omitempty"`
Syscalls []string `json:"syscalls,omitempty"`
FromSource []SyscallFromSource `json:"fromSource,omitempty"`
}

type MatchSyscallPath struct {
Path string `json:"path,omitempty"`
Recursive bool `json:"recursive,omitempty"`
Syscalls []string `json:"syscall,omitempty"`
FromSource []SyscallFromSource `json:"fromSource,omitempty"`
}

type SyscallFromSource struct {
Path string `json:"path,omitempty"`
Dir string `json:"dir,omitempty"`
}

// MatchCapability defines a capability for capabilities policies
type MatchCapability struct {
Capability string `json:"capability,omitempty"`
Capability string `json:"capability,omitempty"`
FromSource []NimbusFromSource `json:"fromSource,omitempty"`
}

// FromSource defines a source path for directory-based policies
Expand Down
13 changes: 11 additions & 2 deletions api/v1/securityintent_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,8 @@ type SecurityIntentParams struct {
MatchCapabilities []SecurityIntentMatchCapability `json:"matchCapabilities,omitempty"`

// Syscalls: MatchSyscalls
MatchSyscalls []SecurityIntentMatchSyscall `json:"matchSyscalls,omitempty"`
MatchSyscalls []SecurityIntentMatchSyscall `json:"matchSyscalls,omitempty"`
MatchSyscallPaths []SecurityIntentMatchSyscallPath `json:"matchSyscallPaths,omitempty"`

FromCIDRSet []SecurityIntentCIDRSet `json:"fromCIDRSet,omitempty"`
ToPorts []SecurityIntentToPort `json:"toPorts,omitempty"`
Expand Down Expand Up @@ -89,7 +90,15 @@ type SecurityIntentMatchPattern struct {

// MatchSyscall defines a syscall for syscall policies
type SecurityIntentMatchSyscall struct {
Syscalls []string `json:"syscalls,omitempty"`
Syscalls []string `json:"syscalls,omitempty"`
FromSource []SyscallFromSource `json:"fromSource,omitempty"`
}

type SecurityIntentMatchSyscallPath struct {
Path string `json:"path,omitempty"`
Recursive bool `json:"recursive,omitempty"`
Syscalls []string `json:"syscall,omitempty"`
FromSource []SyscallFromSource `json:"fromSource,omitempty"`
}

// MatchCapability defines a capability for capabilities policies
Expand Down
9 changes: 4 additions & 5 deletions api/v1/securityintentbinding_types.go
View file
Open in desktop
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We don't need these sophisticated parameters in SecurityIntent; if there is a need for parameters, we'll specify those generically.

Original file line number Diff line number Diff line change
Expand Up @@ -15,11 +15,11 @@ type SecurityIntentBindingSpec struct {
// INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
// Important: Run "make" to regenerate code after modifying this file

// Foo is an example field of SecurityIntentBinding. Edit securityintentbinding_types.go to remove/update
Intents []MatchIntent `json:"intents"`
Selector Selector `json:"selector"`
}

// Intent struct defines the request for a specific SecurityIntent
type MatchIntent struct {
Name string `json:"name"`
}
Expand Down Expand Up @@ -49,9 +49,10 @@ type SecurityIntentBindingStatus struct {
// Important: Run "make" to regenerate code after modifying this file
}

//+kubebuilder:object:root=true
// +kubebuilder:object:root=true
// +kubebuilder:resource: shortName="sib"
//+kubebuilder:subresource:status
// +kubebuilder:subresource:status
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object

// SecurityIntentBinding is the Schema for the securityintentbindings API
type SecurityIntentBinding struct {
Expand All @@ -61,8 +62,6 @@ type SecurityIntentBinding struct {
Status SecurityIntentBindingStatus `json:"status,omitempty"`
}

//+kubebuilder:object:root=true

// SecurityIntentBindingList contains a list of SecurityIntentBinding
type SecurityIntentBindingList struct {
metav1.TypeMeta `json:",inline"`
Expand Down
42 changes: 41 additions & 1 deletion config/crd/bases/intent.security.nimbus.com_nimbuspolicies.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,6 +69,15 @@ spec:
properties:
capability:
type: string
fromSource:
items:
description: FromSource defines a source path
for directory-based policies
properties:
path:
type: string
type: object
type: array
type: object
type: array
matchDirectories:
Expand All @@ -91,7 +100,7 @@ spec:
type: array
matchPaths:
description: 'Process: MatchPaths, MatchDirectories, MatchPatterns
File: MatchPaths, MatchDirectories'
File: MatchPaths, MatchDirectories, MatchPatterns'
items:
description: MatchPath defines a path for process or
file policies
Expand Down Expand Up @@ -119,12 +128,43 @@ spec:
type: string
type: object
type: array
matchSyscallPaths:
items:
properties:
fromSource:
items:
properties:
dir:
type: string
path:
type: string
type: object
type: array
path:
type: string
recursive:
type: boolean
syscall:
items:
type: string
type: array
type: object
type: array
matchSyscalls:
description: 'Syscalls: MatchSyscalls'
items:
description: MatchSyscall defines a syscall for syscall
policies
properties:
fromSource:
items:
properties:
dir:
type: string
path:
type: string
type: object
type: array
syscalls:
items:
type: string
Expand Down
3 changes: 1 addition & 2 deletions config/crd/bases/intent.security.nimbus.com_securityintentbindings.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,9 +38,8 @@ spec:
description: SecurityIntentBindingSpec defines the desired state of SecurityIntentBinding
properties:
intents:
description: Foo is an example field of SecurityIntentBinding. Edit
securityintentbinding_types.go to remove/update
items:
description: Intent struct defines the request for a specific SecurityIntent
properties:
name:
type: string
Expand Down
31 changes: 31 additions & 0 deletions config/crd/bases/intent.security.nimbus.com_securityintents.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,12 +116,43 @@ spec:
type: string
type: object
type: array
matchSyscallPaths:
items:
properties:
fromSource:
items:
properties:
dir:
type: string
path:
type: string
type: object
type: array
path:
type: string
recursive:
type: boolean
syscall:
items:
type: string
type: array
type: object
type: array
matchSyscalls:
description: 'Syscalls: MatchSyscalls'
items:
description: MatchSyscall defines a syscall for syscall
policies
properties:
fromSource:
items:
properties:
dir:
type: string
path:
type: string
type: object
type: array
syscalls:
items:
type: string
Expand Down
Loading
Loading