github/kubernetes
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Move AppArmor profile validation to the API validation pkg

Browse Source
This commit is contained in:
Tim Allclair
2022-02-15 16:17:37 -08:00
parent 455f7c278c
commit 5f2b12e0d4
5 changed files with 42 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
pkg/security/apparmor/validate.go
View File

@@ -28,6 +28,7 @@ import (
v1 "k8s.io/api/core/v1"
utilfeature "k8s.io/apiserver/pkg/util/feature"
podutil "k8s.io/kubernetes/pkg/api/v1/pod"
"k8s.io/kubernetes/pkg/apis/core/validation"
"k8s.io/kubernetes/pkg/features"
utilpath "k8s.io/utils/path"
)
@@ -75,12 +76,12 @@ func (v *validator) Validate(pod *v1.Pod) error {
var retErr error
podutil.VisitContainers(&pod.Spec, podutil.AllContainers, func(container *v1.Container, containerType podutil.ContainerType) bool {
profile := GetProfileName(pod, container.Name)
retErr = ValidateProfileFormat(profile)
retErr = validation.ValidateAppArmorProfileFormat(profile)
if retErr != nil {
return false
}
// TODO(#64841): This would ideally be part of ValidateProfileFormat, but that is called for
// API validation, and this is tightening validation.
// TODO(#64841): This would ideally be part of validation.ValidateAppArmorProfileFormat, but
// that is called for API validation, and this is tightening validation.
if strings.HasPrefix(profile, v1.AppArmorBetaProfileNamePrefix) {
if strings.TrimSpace(strings.TrimPrefix(profile, v1.AppArmorBetaProfileNamePrefix)) == "" {
retErr = fmt.Errorf("invalid empty AppArmor profile name: %q", profile)
@@ -117,17 +118,6 @@ func validateHost() error {
return nil
}
// ValidateProfileFormat checks the format of the profile.
func ValidateProfileFormat(profile string) error {
if profile == "" || profile == v1.AppArmorBetaProfileRuntimeDefault || profile == v1.AppArmorBetaProfileNameUnconfined {
return nil
}
if !strings.HasPrefix(profile, v1.AppArmorBetaProfileNamePrefix) {
return fmt.Errorf("invalid AppArmor profile name: %q", profile)
}
return nil
}
func getAppArmorFS() (string, error) {
mountsFile, err := os.Open("/proc/mounts")
if err != nil {