mirror of
https://github.com/microsoft/regorus.git
synced 2026-08-05 02:16:11 +00:00
Lock down ACI tests and more OPA test folders (#54)
Borrowed from rego-cpp Significantly (> 10 times) faster execution. $ cargo test -r --test aci aci/mount_device passed 9.597958ms aci/mount_overlay passed 10.159208ms aci/scratch_mount passed 8.598875ms aci/create_container passed 10.237292ms aci/shutdown_container passed 6.904084ms aci/scratch_unmount passed 6.530875ms aci/unmount_overlay passed 5.958875ms aci/unmount_device passed 5.657834ms aci/load_fragment passed 6.049917ms Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
This commit is contained in:
Anand Krishnamoorthi
committed by
GitHub
GitHub
parent
639ba72c90
commit
bb0ca29753
@@ -0,0 +1,390 @@
|
||||
# Copyright (c) Microsoft Corporation.
|
||||
# Licensed under the MIT License.
|
||||
cases:
|
||||
- note: aci/mount_device
|
||||
modules:
|
||||
- api.rego
|
||||
- framework.rego
|
||||
- policy.rego
|
||||
input:
|
||||
deviceHash: 1b80f120dbd88e4355d6241b519c3e25290215c469516b49dece9cf07175a766
|
||||
target: /run/layers/p0-layer0
|
||||
data:
|
||||
metadata: {}
|
||||
query: data.policy.mount_device=x
|
||||
want_result:
|
||||
- x:
|
||||
allowed: true
|
||||
metadata:
|
||||
- action: add
|
||||
key: /run/layers/p0-layer0
|
||||
name: devices
|
||||
value: 1b80f120dbd88e4355d6241b519c3e25290215c469516b49dece9cf07175a766
|
||||
- note: aci/mount_overlay
|
||||
modules:
|
||||
- api.rego
|
||||
- framework.rego
|
||||
- policy.rego
|
||||
input:
|
||||
containerID: container0
|
||||
layerPaths:
|
||||
- /run/layers/p0-layer0
|
||||
- /run/layers/p0-layer1
|
||||
- /run/layers/p0-layer2
|
||||
- /run/layers/p0-layer3
|
||||
- /run/layers/p0-layer4
|
||||
- /run/layers/p0-layer5
|
||||
target: /run/gcs/c/container0/rootfs
|
||||
data:
|
||||
metadata:
|
||||
devices:
|
||||
"/run/layers/p0-layer0": 1b80f120dbd88e4355d6241b519c3e25290215c469516b49dece9cf07175a766
|
||||
"/run/layers/p0-layer1": e769d7487cc314d3ee748a4440805317c19262c7acd2fdbdb0d47d2e4613a15c
|
||||
"/run/layers/p0-layer2": eb36921e1f82af46dfe248ef8f1b3afb6a5230a64181d960d10237a08cd73c79
|
||||
"/run/layers/p0-layer3": 41d64cdeb347bf236b4c13b7403b633ff11f1cf94dbc7cf881a44d6da88c5156
|
||||
"/run/layers/p0-layer4": 4dedae42847c704da891a28c25d32201a1ae440bce2aecccfa8e6f03b97a6a6c
|
||||
"/run/layers/p0-layer5": fe84c9d5bfddd07a2624d00333cf13c1a9c941f3a261f13ead44fc6a93bc0e7a
|
||||
query: data.policy.mount_overlay=x
|
||||
want_result:
|
||||
- x:
|
||||
allowed: true
|
||||
metadata:
|
||||
- action: add
|
||||
key: container0
|
||||
name: matches
|
||||
value:
|
||||
- {"allow_elevated":true,"allow_stdio_access":false,"capabilities":{"ambient":["CAP_SYS_ADMIN"],"bounding":["CAP_SYS_ADMIN"],"effective":["CAP_SYS_ADMIN"],"inheritable":["CAP_SYS_ADMIN"],"permitted":["CAP_SYS_ADMIN"]},"command":["rustc","--help"],"env_rules":[{"pattern":"PATH=/usr/local/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin","required":true,"strategy":"string"},{"pattern":"RUSTUP_HOME=/usr/local/rustup","required":true,"strategy":"string"},{"pattern":"CARGO_HOME=/usr/local/cargo","required":true,"strategy":"string"},{"pattern":"RUST_VERSION=1.52.1","required":true,"strategy":"string"},{"pattern":"TERM=xterm","required":false,"strategy":"string"},{"pattern":"PREFIX_.+=.+","required":false,"strategy":"re2"}],"exec_processes":[{"command":["top"],"signals":[]}],"layers":["fe84c9d5bfddd07a2624d00333cf13c1a9c941f3a261f13ead44fc6a93bc0e7a","4dedae42847c704da891a28c25d32201a1ae440bce2aecccfa8e6f03b97a6a6c","41d64cdeb347bf236b4c13b7403b633ff11f1cf94dbc7cf881a44d6da88c5156","eb36921e1f82af46dfe248ef8f1b3afb6a5230a64181d960d10237a08cd73c79","e769d7487cc314d3ee748a4440805317c19262c7acd2fdbdb0d47d2e4613a15c","1b80f120dbd88e4355d6241b519c3e25290215c469516b49dece9cf07175a766"],"mounts":[{"destination":"/container/path/one","options":["rbind","rshared","rw"],"source":"sandbox:///host/path/one","type":"bind"},{"destination":"/container/path/two","options":["rbind","rshared","ro"],"source":"sandbox:///host/path/two","type":"bind"}],"no_new_privileges":true,"seccomp_profile_sha256":"","signals":[],"user":{"group_idnames":[{"pattern":"","strategy":"any"}],"umask":"0022","user_idname":{"pattern":"","strategy":"any"}},"working_dir":"/home/user"}
|
||||
- action: add
|
||||
key: /run/gcs/c/container0/rootfs
|
||||
name: overlayTargets
|
||||
value: true
|
||||
- note: aci/scratch_mount
|
||||
modules:
|
||||
- api.rego
|
||||
- framework.rego
|
||||
- policy.rego
|
||||
input:
|
||||
encrypted: true
|
||||
target: /mnt/layer6
|
||||
data:
|
||||
metadata: {}
|
||||
query: data.policy.scratch_mount=x
|
||||
want_result:
|
||||
- x:
|
||||
allowed: true
|
||||
metadata:
|
||||
- action: add
|
||||
key: /mnt/layer6
|
||||
name: scratch_mounts
|
||||
value:
|
||||
encrypted: true
|
||||
- note: aci/create_container
|
||||
modules:
|
||||
- api.rego
|
||||
- framework.rego
|
||||
- policy.rego
|
||||
input:
|
||||
argList:
|
||||
- rustc
|
||||
- --help
|
||||
capabilities:
|
||||
ambient: ["CAP_SYS_ADMIN"]
|
||||
bounding: ["CAP_SYS_ADMIN"]
|
||||
effective: ["CAP_SYS_ADMIN"]
|
||||
inheritable: ["CAP_SYS_ADMIN"]
|
||||
permitted: ["CAP_SYS_ADMIN"]
|
||||
containerID: container0
|
||||
envList:
|
||||
- CARGO_HOME=/usr/local/cargo
|
||||
- RUST_VERSION=1.52.1
|
||||
- TERM=xterm
|
||||
- PATH=/usr/local/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
||||
- RUSTUP_HOME=/usr/local/rustup
|
||||
groups:
|
||||
- id: 0
|
||||
name: root
|
||||
hugePagesDir: /run/gcs/c/sandbox0/hugepages
|
||||
mounts:
|
||||
- destination: /container/path/one
|
||||
options: ["rbind", "rshared", "rw"]
|
||||
source: /run/gcs/c/sandbox0/sandboxMounts/host/path/one
|
||||
type: bind
|
||||
- destination: /container/path/two
|
||||
options: ["rbind", "rshared", "ro"]
|
||||
source: /run/gcs/c/sandbox0/sandboxMounts/host/path/two
|
||||
type: bind
|
||||
noNewPrivileges: true
|
||||
privileged: false
|
||||
seccompProfileSHA256: ""
|
||||
sandboxDir: /run/gcs/c/sandbox0/sandboxMounts
|
||||
umask: "0022"
|
||||
user:
|
||||
id: 0
|
||||
name: root
|
||||
workingDir: /home/user
|
||||
data:
|
||||
sandboxPrefix: "sandbox://"
|
||||
hugePagesPrefix: "hugepages://"
|
||||
plan9Prefix: "plan9://"
|
||||
defaultMounts: []
|
||||
privilegedMounts: []
|
||||
defaultPrivilegedCapabilities:
|
||||
- CAP_CHOWN
|
||||
- CAP_DAC_OVERRIDE
|
||||
- CAP_DAC_READ_SEARCH
|
||||
- CAP_FOWNER
|
||||
- CAP_FSETID
|
||||
- CAP_KILL
|
||||
- CAP_SETGID
|
||||
- CAP_SETUID
|
||||
- CAP_SETPCAP
|
||||
- CAP_LINUX_IMMUTABLE
|
||||
- CAP_NET_BIND_SERVICE
|
||||
- CAP_NET_BROADCAST
|
||||
- CAP_NET_ADMIN
|
||||
- CAP_NET_RAW
|
||||
- CAP_IPC_LOCK
|
||||
- CAP_IPC_OWNER
|
||||
- CAP_SYS_MODULE
|
||||
- CAP_SYS_RAWIO
|
||||
- CAP_SYS_CHROOT
|
||||
- CAP_SYS_PTRACE
|
||||
- CAP_SYS_PACCT
|
||||
- CAP_SYS_ADMIN
|
||||
- CAP_SYS_BOOT
|
||||
- CAP_SYS_NICE
|
||||
- CAP_SYS_RESOURCE
|
||||
- CAP_SYS_TIME
|
||||
- CAP_SYS_TTY_CONFIG
|
||||
- CAP_MKNOD
|
||||
- CAP_LEASE
|
||||
- CAP_AUDIT_WRITE
|
||||
- CAP_AUDIT_CONTROL
|
||||
- CAP_SETFCAP
|
||||
- CAP_MAC_OVERRIDE
|
||||
- CAP_MAC_ADMIN
|
||||
- CAP_SYSLOG
|
||||
- CAP_WAKE_ALARM
|
||||
- CAP_BLOCK_SUSPEND
|
||||
- CAP_AUDIT_READ
|
||||
- CAP_PERFMON
|
||||
- CAP_BPF
|
||||
- CAP_CHECKPOINT_RESTORE
|
||||
defaultUnprivilegedCapabilities:
|
||||
- CAP_DAC_OVERRIDE
|
||||
- CAP_FSETID
|
||||
- CAP_FOWNER
|
||||
- CAP_MKNOD
|
||||
- CAP_NET_RAW
|
||||
- CAP_SETGID
|
||||
- CAP_SETUID
|
||||
- CAP_SETFCAP
|
||||
- CAP_SETPCAP
|
||||
- CAP_NET_BIND_SERVICE
|
||||
- CAP_SYS_CHROOT
|
||||
- CAP_KILL
|
||||
- CAP_AUDIT_WRITE
|
||||
metadata:
|
||||
devices:
|
||||
"/run/layers/p0-layer0": 1b80f120dbd88e4355d6241b519c3e25290215c469516b49dece9cf07175a766
|
||||
"/run/layers/p0-layer1": e769d7487cc314d3ee748a4440805317c19262c7acd2fdbdb0d47d2e4613a15c
|
||||
"/run/layers/p0-layer2": eb36921e1f82af46dfe248ef8f1b3afb6a5230a64181d960d10237a08cd73c79
|
||||
"/run/layers/p0-layer3": 41d64cdeb347bf236b4c13b7403b633ff11f1cf94dbc7cf881a44d6da88c5156
|
||||
"/run/layers/p0-layer4": 4dedae42847c704da891a28c25d32201a1ae440bce2aecccfa8e6f03b97a6a6c
|
||||
"/run/layers/p0-layer5": fe84c9d5bfddd07a2624d00333cf13c1a9c941f3a261f13ead44fc6a93bc0e7a
|
||||
matches:
|
||||
container0:
|
||||
- {"allow_elevated":true,"allow_stdio_access":false,"capabilities":{"ambient":["CAP_SYS_ADMIN"],"bounding":["CAP_SYS_ADMIN"],"effective":["CAP_SYS_ADMIN"],"inheritable":["CAP_SYS_ADMIN"],"permitted":["CAP_SYS_ADMIN"]},"command":["rustc","--help"],"env_rules":[{"pattern":"PATH=/usr/local/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin","required":true,"strategy":"string"},{"pattern":"RUSTUP_HOME=/usr/local/rustup","required":true,"strategy":"string"},{"pattern":"CARGO_HOME=/usr/local/cargo","required":true,"strategy":"string"},{"pattern":"RUST_VERSION=1.52.1","required":true,"strategy":"string"},{"pattern":"TERM=xterm","required":false,"strategy":"string"},{"pattern":"PREFIX_.+=.+","required":false,"strategy":"re2"}],"exec_processes":[{"command":["top"],"signals":[]}],"layers":["fe84c9d5bfddd07a2624d00333cf13c1a9c941f3a261f13ead44fc6a93bc0e7a","4dedae42847c704da891a28c25d32201a1ae440bce2aecccfa8e6f03b97a6a6c","41d64cdeb347bf236b4c13b7403b633ff11f1cf94dbc7cf881a44d6da88c5156","eb36921e1f82af46dfe248ef8f1b3afb6a5230a64181d960d10237a08cd73c79","e769d7487cc314d3ee748a4440805317c19262c7acd2fdbdb0d47d2e4613a15c","1b80f120dbd88e4355d6241b519c3e25290215c469516b49dece9cf07175a766"],"mounts":[{"destination":"/container/path/one","options":["rbind","rshared","rw"],"source":"sandbox:///host/path/one","type":"bind"},{"destination":"/container/path/two","options":["rbind","rshared","ro"],"source":"sandbox:///host/path/two","type":"bind"}],"no_new_privileges":true,"seccomp_profile_sha256":"","signals":[],"user":{"group_idnames":[{"pattern":"","strategy":"any"}],"umask":"0022","user_idname":{"pattern":"","strategy":"any"}},"working_dir":"/home/user"}
|
||||
- {"allow_elevated":false,"allow_stdio_access":false,"capabilities":null,"command":["rustc","--version"],"env_rules":[{"pattern":"PATH=/usr/local/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin","required":true,"strategy":"string"},{"pattern":"RUSTUP_HOME=/usr/local/rustup","required":true,"strategy":"string"},{"pattern":"CARGO_HOME=/usr/local/cargo","required":true,"strategy":"string"},{"pattern":"RUST_VERSION=1.52.1","required":true,"strategy":"string"},{"pattern":"TERM=xterm","required":false,"strategy":"string"}],"exec_processes":[{"command":["bash"],"signals":[]}],"layers":["fe84c9d5bfddd07a2624d00333cf13c1a9c941f3a261f13ead44fc6a93bc0e7a","4dedae42847c704da891a28c25d32201a1ae440bce2aecccfa8e6f03b97a6a6c","41d64cdeb347bf236b4c13b7403b633ff11f1cf94dbc7cf881a44d6da88c5156","eb36921e1f82af46dfe248ef8f1b3afb6a5230a64181d960d10237a08cd73c79","e769d7487cc314d3ee748a4440805317c19262c7acd2fdbdb0d47d2e4613a15c","1b80f120dbd88e4355d6241b519c3e25290215c469516b49dece9cf07175a766"],"mounts":[],"no_new_privileges":true,"seccomp_profile_sha256":"","signals":[],"user":{"group_idnames":[{"pattern":"","strategy":"any"}],"umask":"0022","user_idname":{"pattern":"","strategy":"any"}},"working_dir":"/home/fragment"}
|
||||
overlayTargets:
|
||||
"/run/gcs/c/container0/rootfs": true
|
||||
scratch_mounts:
|
||||
"/mnt/layer6":
|
||||
encrypted: true
|
||||
query: data.policy.create_container=x
|
||||
want_result:
|
||||
- x:
|
||||
allow_stdio_access: false
|
||||
allowed: true
|
||||
caps_list:
|
||||
ambient: ["CAP_SYS_ADMIN"]
|
||||
bounding: ["CAP_SYS_ADMIN"]
|
||||
effective: ["CAP_SYS_ADMIN"]
|
||||
inheritable: ["CAP_SYS_ADMIN"]
|
||||
permitted: ["CAP_SYS_ADMIN"]
|
||||
env_list:
|
||||
- CARGO_HOME=/usr/local/cargo
|
||||
- RUST_VERSION=1.52.1
|
||||
- TERM=xterm
|
||||
- PATH=/usr/local/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
||||
- RUSTUP_HOME=/usr/local/rustup
|
||||
metadata:
|
||||
- action: update
|
||||
key: container0
|
||||
name: matches
|
||||
value:
|
||||
- {"allow_elevated":true,"allow_stdio_access":false,"capabilities":{"ambient":["CAP_SYS_ADMIN"],"bounding":["CAP_SYS_ADMIN"],"effective":["CAP_SYS_ADMIN"],"inheritable":["CAP_SYS_ADMIN"],"permitted":["CAP_SYS_ADMIN"]},"command":["rustc","--help"],"env_rules":[{"pattern":"PATH=/usr/local/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin","required":true,"strategy":"string"},{"pattern":"RUSTUP_HOME=/usr/local/rustup","required":true,"strategy":"string"},{"pattern":"CARGO_HOME=/usr/local/cargo","required":true,"strategy":"string"},{"pattern":"RUST_VERSION=1.52.1","required":true,"strategy":"string"},{"pattern":"TERM=xterm","required":false,"strategy":"string"},{"pattern":"PREFIX_.+=.+","required":false,"strategy":"re2"}],"exec_processes":[{"command":["top"],"signals":[]}],"layers":["fe84c9d5bfddd07a2624d00333cf13c1a9c941f3a261f13ead44fc6a93bc0e7a","4dedae42847c704da891a28c25d32201a1ae440bce2aecccfa8e6f03b97a6a6c","41d64cdeb347bf236b4c13b7403b633ff11f1cf94dbc7cf881a44d6da88c5156","eb36921e1f82af46dfe248ef8f1b3afb6a5230a64181d960d10237a08cd73c79","e769d7487cc314d3ee748a4440805317c19262c7acd2fdbdb0d47d2e4613a15c","1b80f120dbd88e4355d6241b519c3e25290215c469516b49dece9cf07175a766"],"mounts":[{"destination":"/container/path/one","options":["rbind","rshared","rw"],"source":"sandbox:///host/path/one","type":"bind"},{"destination":"/container/path/two","options":["rbind","rshared","ro"],"source":"sandbox:///host/path/two","type":"bind"}],"no_new_privileges":true,"seccomp_profile_sha256":"","signals":[],"user":{"group_idnames":[{"pattern":"","strategy":"any"}],"umask":"0022","user_idname":{"pattern":"","strategy":"any"}},"working_dir":"/home/user"}
|
||||
- action: add
|
||||
key: container0
|
||||
name: started
|
||||
value:
|
||||
privileged: false
|
||||
- note: aci/shutdown_container
|
||||
modules:
|
||||
- api.rego
|
||||
- framework.rego
|
||||
- policy.rego
|
||||
input:
|
||||
containerID: container0
|
||||
data:
|
||||
metadata:
|
||||
devices:
|
||||
"/run/layers/p0-layer0": 1b80f120dbd88e4355d6241b519c3e25290215c469516b49dece9cf07175a766
|
||||
"/run/layers/p0-layer1": e769d7487cc314d3ee748a4440805317c19262c7acd2fdbdb0d47d2e4613a15c
|
||||
"/run/layers/p0-layer2": eb36921e1f82af46dfe248ef8f1b3afb6a5230a64181d960d10237a08cd73c79
|
||||
"/run/layers/p0-layer3": 41d64cdeb347bf236b4c13b7403b633ff11f1cf94dbc7cf881a44d6da88c5156
|
||||
"/run/layers/p0-layer4": 4dedae42847c704da891a28c25d32201a1ae440bce2aecccfa8e6f03b97a6a6c
|
||||
"/run/layers/p0-layer5": fe84c9d5bfddd07a2624d00333cf13c1a9c941f3a261f13ead44fc6a93bc0e7a
|
||||
matches:
|
||||
container0:
|
||||
- {"allow_elevated":true,"allow_stdio_access":false,"capabilities":{"ambient":["CAP_SYS_ADMIN"],"bounding":["CAP_SYS_ADMIN"],"effective":["CAP_SYS_ADMIN"],"inheritable":["CAP_SYS_ADMIN"],"permitted":["CAP_SYS_ADMIN"]},"command":["rustc","--help"],"env_rules":[{"pattern":"PATH=/usr/local/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin","required":true,"strategy":"string"},{"pattern":"RUSTUP_HOME=/usr/local/rustup","required":true,"strategy":"string"},{"pattern":"CARGO_HOME=/usr/local/cargo","required":true,"strategy":"string"},{"pattern":"RUST_VERSION=1.52.1","required":true,"strategy":"string"},{"pattern":"TERM=xterm","required":false,"strategy":"string"},{"pattern":"PREFIX_.+=.+","required":false,"strategy":"re2"}],"exec_processes":[{"command":["top"],"signals":[]}],"layers":["fe84c9d5bfddd07a2624d00333cf13c1a9c941f3a261f13ead44fc6a93bc0e7a","4dedae42847c704da891a28c25d32201a1ae440bce2aecccfa8e6f03b97a6a6c","41d64cdeb347bf236b4c13b7403b633ff11f1cf94dbc7cf881a44d6da88c5156","eb36921e1f82af46dfe248ef8f1b3afb6a5230a64181d960d10237a08cd73c79","e769d7487cc314d3ee748a4440805317c19262c7acd2fdbdb0d47d2e4613a15c","1b80f120dbd88e4355d6241b519c3e25290215c469516b49dece9cf07175a766"],"mounts":[{"destination":"/container/path/one","options":["rbind","rshared","rw"],"source":"sandbox:///host/path/one","type":"bind"},{"destination":"/container/path/two","options":["rbind","rshared","ro"],"source":"sandbox:///host/path/two","type":"bind"}],"no_new_privileges":true,"seccomp_profile_sha256":"","signals":[],"user":{"group_idnames":[{"pattern":"","strategy":"any"}],"umask":"0022","user_idname":{"pattern":"","strategy":"any"}},"working_dir":"/home/user"}
|
||||
- {"allow_elevated":false,"allow_stdio_access":false,"capabilities":null,"command":["rustc","--version"],"env_rules":[{"pattern":"PATH=/usr/local/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin","required":true,"strategy":"string"},{"pattern":"RUSTUP_HOME=/usr/local/rustup","required":true,"strategy":"string"},{"pattern":"CARGO_HOME=/usr/local/cargo","required":true,"strategy":"string"},{"pattern":"RUST_VERSION=1.52.1","required":true,"strategy":"string"},{"pattern":"TERM=xterm","required":false,"strategy":"string"}],"exec_processes":[{"command":["bash"],"signals":[]}],"layers":["fe84c9d5bfddd07a2624d00333cf13c1a9c941f3a261f13ead44fc6a93bc0e7a","4dedae42847c704da891a28c25d32201a1ae440bce2aecccfa8e6f03b97a6a6c","41d64cdeb347bf236b4c13b7403b633ff11f1cf94dbc7cf881a44d6da88c5156","eb36921e1f82af46dfe248ef8f1b3afb6a5230a64181d960d10237a08cd73c79","e769d7487cc314d3ee748a4440805317c19262c7acd2fdbdb0d47d2e4613a15c","1b80f120dbd88e4355d6241b519c3e25290215c469516b49dece9cf07175a766"],"mounts":[],"no_new_privileges":true,"seccomp_profile_sha256":"","signals":[],"user":{"group_idnames":[{"pattern":"","strategy":"any"}],"umask":"0022","user_idname":{"pattern":"","strategy":"any"}},"working_dir":"/home/fragment"}
|
||||
overlayTargets:
|
||||
"/run/gcs/c/container0/rootfs": true
|
||||
scratch_mounts:
|
||||
"/mnt/layer6":
|
||||
encrypted: true
|
||||
started:
|
||||
container0:
|
||||
- {"privileged": false}
|
||||
query: data.policy.shutdown_container=x
|
||||
want_result:
|
||||
- x:
|
||||
allowed: true
|
||||
metadata:
|
||||
- action: remove
|
||||
key: container0
|
||||
name: matches
|
||||
- note: aci/scratch_unmount
|
||||
modules:
|
||||
- api.rego
|
||||
- framework.rego
|
||||
- policy.rego
|
||||
input:
|
||||
unmountTarget: /mnt/layer6
|
||||
data:
|
||||
metadata:
|
||||
devices:
|
||||
"/run/layers/p0-layer0": 1b80f120dbd88e4355d6241b519c3e25290215c469516b49dece9cf07175a766
|
||||
"/run/layers/p0-layer1": e769d7487cc314d3ee748a4440805317c19262c7acd2fdbdb0d47d2e4613a15c
|
||||
"/run/layers/p0-layer2": eb36921e1f82af46dfe248ef8f1b3afb6a5230a64181d960d10237a08cd73c79
|
||||
"/run/layers/p0-layer3": 41d64cdeb347bf236b4c13b7403b633ff11f1cf94dbc7cf881a44d6da88c5156
|
||||
"/run/layers/p0-layer4": 4dedae42847c704da891a28c25d32201a1ae440bce2aecccfa8e6f03b97a6a6c
|
||||
"/run/layers/p0-layer5": fe84c9d5bfddd07a2624d00333cf13c1a9c941f3a261f13ead44fc6a93bc0e7a
|
||||
overlayTargets:
|
||||
"/run/gcs/c/container0/rootfs": true
|
||||
scratch_mounts:
|
||||
"/mnt/layer6":
|
||||
encrypted: true
|
||||
query: data.policy.scratch_unmount=x
|
||||
want_result:
|
||||
- x:
|
||||
allowed: true
|
||||
metadata:
|
||||
- action: remove
|
||||
key: /mnt/layer6
|
||||
name: scratch_mounts
|
||||
- note: aci/unmount_overlay
|
||||
modules:
|
||||
- api.rego
|
||||
- framework.rego
|
||||
- policy.rego
|
||||
input:
|
||||
unmountTarget: /run/gcs/c/container0/rootfs
|
||||
data:
|
||||
metadata:
|
||||
devices:
|
||||
"/run/layers/p0-layer0": 1b80f120dbd88e4355d6241b519c3e25290215c469516b49dece9cf07175a766
|
||||
"/run/layers/p0-layer1": e769d7487cc314d3ee748a4440805317c19262c7acd2fdbdb0d47d2e4613a15c
|
||||
"/run/layers/p0-layer2": eb36921e1f82af46dfe248ef8f1b3afb6a5230a64181d960d10237a08cd73c79
|
||||
"/run/layers/p0-layer3": 41d64cdeb347bf236b4c13b7403b633ff11f1cf94dbc7cf881a44d6da88c5156
|
||||
"/run/layers/p0-layer4": 4dedae42847c704da891a28c25d32201a1ae440bce2aecccfa8e6f03b97a6a6c
|
||||
"/run/layers/p0-layer5": fe84c9d5bfddd07a2624d00333cf13c1a9c941f3a261f13ead44fc6a93bc0e7a
|
||||
overlayTargets:
|
||||
"/run/gcs/c/container0/rootfs": true
|
||||
scratch_mounts: []
|
||||
query: data.policy.unmount_overlay=x
|
||||
want_result:
|
||||
- x:
|
||||
allowed: true
|
||||
metadata:
|
||||
- action: remove
|
||||
key: /run/gcs/c/container0/rootfs
|
||||
name: overlayTargets
|
||||
- note: aci/unmount_device
|
||||
modules:
|
||||
- api.rego
|
||||
- framework.rego
|
||||
- policy.rego
|
||||
input:
|
||||
unmountTarget: /run/layers/p0-layer0
|
||||
data:
|
||||
metadata:
|
||||
devices:
|
||||
"/run/layers/p0-layer0": 1b80f120dbd88e4355d6241b519c3e25290215c469516b49dece9cf07175a766
|
||||
query: data.policy.unmount_device=x
|
||||
want_result:
|
||||
- x:
|
||||
allowed: true
|
||||
metadata:
|
||||
- action: remove
|
||||
key: /run/layers/p0-layer0
|
||||
name: devices
|
||||
- note: aci/load_fragment
|
||||
modules:
|
||||
- api.rego
|
||||
- framework.rego
|
||||
- policy.rego
|
||||
- |
|
||||
package fragment
|
||||
|
||||
svn := "1"
|
||||
framework_version := "0.3.0"
|
||||
|
||||
containers := [
|
||||
{
|
||||
"command": ["rustc","--version"],
|
||||
"env_rules": [{"pattern": `PATH=/usr/local/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin`, "strategy": "string", "required": true},{"pattern": `RUSTUP_HOME=/usr/local/rustup`, "strategy": "string", "required": true},{"pattern": `CARGO_HOME=/usr/local/cargo`, "strategy": "string", "required": true},{"pattern": `RUST_VERSION=1.52.1`, "strategy": "string", "required": true},{"pattern": `TERM=xterm`, "strategy": "string", "required": false}],
|
||||
"layers": ["fe84c9d5bfddd07a2624d00333cf13c1a9c941f3a261f13ead44fc6a93bc0e7a","4dedae42847c704da891a28c25d32201a1ae440bce2aecccfa8e6f03b97a6a6c","41d64cdeb347bf236b4c13b7403b633ff11f1cf94dbc7cf881a44d6da88c5156","eb36921e1f82af46dfe248ef8f1b3afb6a5230a64181d960d10237a08cd73c79","e769d7487cc314d3ee748a4440805317c19262c7acd2fdbdb0d47d2e4613a15c","1b80f120dbd88e4355d6241b519c3e25290215c469516b49dece9cf07175a766"],
|
||||
"mounts": [],
|
||||
"exec_processes": [{"command": ["bash"], "signals": []}],
|
||||
"signals": [],
|
||||
"user": {
|
||||
"user_idname": {"pattern": ``, "strategy": "any"},
|
||||
"group_idnames": [{"pattern": ``, "strategy": "any"}],
|
||||
"umask": "0022"
|
||||
},
|
||||
"capabilities": null,
|
||||
"seccomp_profile_sha256": "",
|
||||
"allow_elevated": false,
|
||||
"working_dir": "/home/fragment",
|
||||
"allow_stdio_access": false,
|
||||
"no_new_privileges": true,
|
||||
},
|
||||
]
|
||||
input:
|
||||
feed: contoso.azurecr.io/infra
|
||||
issuer: did:web:contoso.com
|
||||
namespace: fragment
|
||||
data:
|
||||
metadata: {}
|
||||
query: data.policy.load_fragment=x
|
||||
want_result:
|
||||
- x:
|
||||
add_module: false
|
||||
allowed: true
|
||||
metadata:
|
||||
- action: update
|
||||
key: did:web:contoso.com
|
||||
name: issuers
|
||||
value: {"feeds":{"contoso.azurecr.io/infra":[{"containers":[{"allow_elevated":false,"allow_stdio_access":false,"capabilities":null,"command":["rustc","--version"],"env_rules":[{"pattern":"PATH=/usr/local/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin","required":true,"strategy":"string"},{"pattern":"RUSTUP_HOME=/usr/local/rustup","required":true,"strategy":"string"},{"pattern":"CARGO_HOME=/usr/local/cargo","required":true,"strategy":"string"},{"pattern":"RUST_VERSION=1.52.1","required":true,"strategy":"string"},{"pattern":"TERM=xterm","required":false,"strategy":"string"}],"exec_processes":[{"command":["bash"],"signals":[]}],"layers":["fe84c9d5bfddd07a2624d00333cf13c1a9c941f3a261f13ead44fc6a93bc0e7a","4dedae42847c704da891a28c25d32201a1ae440bce2aecccfa8e6f03b97a6a6c","41d64cdeb347bf236b4c13b7403b633ff11f1cf94dbc7cf881a44d6da88c5156","eb36921e1f82af46dfe248ef8f1b3afb6a5230a64181d960d10237a08cd73c79","e769d7487cc314d3ee748a4440805317c19262c7acd2fdbdb0d47d2e4613a15c","1b80f120dbd88e4355d6241b519c3e25290215c469516b49dece9cf07175a766"],"mounts":[],"no_new_privileges":true,"seccomp_profile_sha256":"","signals":[],"user":{"group_idnames":[{"pattern":"","strategy":"any"}],"umask":"0022","user_idname":{"pattern":"","strategy":"any"}},"working_dir":"/home/fragment"}]}]}}
|
||||
@@ -0,0 +1,26 @@
|
||||
# Copyright (c) Microsoft Corporation.
|
||||
# Licensed under the MIT License.
|
||||
|
||||
package api
|
||||
|
||||
version := "0.10.0"
|
||||
|
||||
enforcement_points := {
|
||||
"mount_device": {"introducedVersion": "0.1.0", "default_results": {"allowed": false}},
|
||||
"mount_overlay": {"introducedVersion": "0.1.0", "default_results": {"allowed": false}},
|
||||
"create_container": {"introducedVersion": "0.1.0", "default_results": {"allowed": false, "env_list": null, "allow_stdio_access": false}},
|
||||
"unmount_device": {"introducedVersion": "0.2.0", "default_results": {"allowed": true}},
|
||||
"unmount_overlay": {"introducedVersion": "0.6.0", "default_results": {"allowed": true}},
|
||||
"exec_in_container": {"introducedVersion": "0.2.0", "default_results": {"allowed": true, "env_list": null}},
|
||||
"exec_external": {"introducedVersion": "0.3.0", "default_results": {"allowed": true, "env_list": null, "allow_stdio_access": false}},
|
||||
"shutdown_container": {"introducedVersion": "0.4.0", "default_results": {"allowed": true}},
|
||||
"signal_container_process": {"introducedVersion": "0.5.0", "default_results": {"allowed": true}},
|
||||
"plan9_mount": {"introducedVersion": "0.6.0", "default_results": {"allowed": true}},
|
||||
"plan9_unmount": {"introducedVersion": "0.6.0", "default_results": {"allowed": true}},
|
||||
"get_properties": {"introducedVersion": "0.7.0", "default_results": {"allowed": true}},
|
||||
"dump_stacks": {"introducedVersion": "0.7.0", "default_results": {"allowed": true}},
|
||||
"runtime_logging": {"introducedVersion": "0.8.0", "default_results": {"allowed": true}},
|
||||
"load_fragment": {"introducedVersion": "0.9.0", "default_results": {"allowed": false, "add_module": false}},
|
||||
"scratch_mount": {"introducedVersion": "0.10.0", "default_results": {"allowed": true}},
|
||||
"scratch_unmount": {"introducedVersion": "0.10.0", "default_results": {"allowed": true}},
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,120 @@
|
||||
// Copyright (c) Microsoft Corporation.
|
||||
// Licensed under the MIT License.
|
||||
use regorus::*;
|
||||
|
||||
use std::path::Path;
|
||||
use std::time::Instant;
|
||||
|
||||
use anyhow::Result;
|
||||
use clap::Parser;
|
||||
use serde::{Deserialize, Serialize};
|
||||
use walkdir::WalkDir;
|
||||
|
||||
#[derive(Serialize, Deserialize, PartialEq, Debug)]
|
||||
struct TestCase {
|
||||
note: String,
|
||||
data: Value,
|
||||
input: Value,
|
||||
modules: Vec<String>,
|
||||
query: String,
|
||||
want_result: Value,
|
||||
}
|
||||
|
||||
#[derive(Serialize, Deserialize, PartialEq, Debug)]
|
||||
struct YamlTest {
|
||||
cases: Vec<TestCase>,
|
||||
}
|
||||
|
||||
fn eval_test_case(dir: &Path, case: &TestCase) -> Result<Value> {
|
||||
let mut engine = Engine::new();
|
||||
|
||||
engine.add_data(case.data.clone())?;
|
||||
engine.set_input(case.input.clone());
|
||||
|
||||
for (idx, rego) in case.modules.iter().enumerate() {
|
||||
if rego.ends_with(".rego") {
|
||||
let path = dir.join(rego);
|
||||
let path = path.to_str().expect("not a valid path");
|
||||
engine.add_policy_from_file(path.to_string())?;
|
||||
} else {
|
||||
engine.add_policy(format!("rego{idx}.rego"), rego.clone())?;
|
||||
}
|
||||
}
|
||||
|
||||
let query_results = engine.eval_query(case.query.clone(), true)?;
|
||||
|
||||
let mut values = vec![];
|
||||
for qr in query_results.result {
|
||||
values.push(if !qr.bindings.is_empty_object() {
|
||||
qr.bindings.clone()
|
||||
} else if let Some(v) = qr.expressions.last() {
|
||||
v["value"].clone()
|
||||
} else {
|
||||
Value::Undefined
|
||||
});
|
||||
}
|
||||
let result = Value::from_array(values);
|
||||
// Make result json compatible. (E.g: avoid sets).
|
||||
Value::from_json_str(&result.to_string())
|
||||
}
|
||||
|
||||
fn run_aci_tests(dir: &Path) -> Result<()> {
|
||||
let mut nfailures = 0;
|
||||
for entry in WalkDir::new(dir)
|
||||
.sort_by_file_name()
|
||||
.into_iter()
|
||||
.filter_map(|e| e.ok())
|
||||
{
|
||||
let path = entry.path();
|
||||
if !path.to_string_lossy().ends_with(".yaml") {
|
||||
continue;
|
||||
}
|
||||
|
||||
let yaml = std::fs::read(&path)?;
|
||||
let yaml = String::from_utf8_lossy(&yaml);
|
||||
let test: YamlTest = serde_yaml::from_str(&yaml)?;
|
||||
|
||||
for case in &test.cases {
|
||||
print!("{:50}", case.note);
|
||||
let start = Instant::now();
|
||||
let results = eval_test_case(dir, case);
|
||||
let duration = start.elapsed();
|
||||
|
||||
match results {
|
||||
Ok(actual) if actual == case.want_result => {
|
||||
println!("passed {:?}", duration);
|
||||
}
|
||||
Ok(actual) => {
|
||||
println!("failed {:?}", duration);
|
||||
println!("ACTUAL:");
|
||||
println!("{}", serde_json::to_string(&actual)?);
|
||||
println!("EXPECTED");
|
||||
println!("{}", serde_json::to_string(&case.want_result)?);
|
||||
nfailures += 1;
|
||||
}
|
||||
Err(e) => {
|
||||
println!("failed {:?}", duration);
|
||||
println!("{e}");
|
||||
nfailures += 1;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
assert!(nfailures == 0);
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
#[derive(clap::Parser)]
|
||||
#[command(author, version, about, long_about = None)]
|
||||
struct Cli {
|
||||
/// Path to ACI test suite.
|
||||
#[arg(long, short)]
|
||||
#[clap(default_value = "tests/aci")]
|
||||
test_dir: String,
|
||||
}
|
||||
|
||||
fn main() -> Result<()> {
|
||||
let cli = Cli::parse();
|
||||
run_aci_tests(&Path::new(&cli.test_dir))
|
||||
}
|
||||
@@ -0,0 +1,89 @@
|
||||
# Copyright (c) Microsoft Corporation.
|
||||
# Licensed under the MIT License.
|
||||
|
||||
package policy
|
||||
|
||||
api_version := "0.10.0"
|
||||
framework_version := "0.3.0"
|
||||
|
||||
fragments := [
|
||||
{"issuer": "did:web:contoso.com", "feed": "contoso.azurecr.io/infra", "minimum_svn": "1", "includes": ["containers"]},
|
||||
]
|
||||
containers := [
|
||||
{
|
||||
"command": ["rustc","--help"],
|
||||
"env_rules": [{"pattern": `PATH=/usr/local/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin`, "strategy": "string", "required": true},{"pattern": `RUSTUP_HOME=/usr/local/rustup`, "strategy": "string", "required": true},{"pattern": `CARGO_HOME=/usr/local/cargo`, "strategy": "string", "required": true},{"pattern": `RUST_VERSION=1.52.1`, "strategy": "string", "required": true},{"pattern": `TERM=xterm`, "strategy": "string", "required": false},{"pattern": `PREFIX_.+=.+`, "strategy": "re2", "required": false}],
|
||||
"layers": ["fe84c9d5bfddd07a2624d00333cf13c1a9c941f3a261f13ead44fc6a93bc0e7a","4dedae42847c704da891a28c25d32201a1ae440bce2aecccfa8e6f03b97a6a6c","41d64cdeb347bf236b4c13b7403b633ff11f1cf94dbc7cf881a44d6da88c5156","eb36921e1f82af46dfe248ef8f1b3afb6a5230a64181d960d10237a08cd73c79","e769d7487cc314d3ee748a4440805317c19262c7acd2fdbdb0d47d2e4613a15c","1b80f120dbd88e4355d6241b519c3e25290215c469516b49dece9cf07175a766"],
|
||||
"mounts": [{"destination": "/container/path/one", "options": ["rbind","rshared","rw"], "source": "sandbox:///host/path/one", "type": "bind"},{"destination": "/container/path/two", "options": ["rbind","rshared","ro"], "source": "sandbox:///host/path/two", "type": "bind"}],
|
||||
"exec_processes": [{"command": ["top"], "signals": []}],
|
||||
"signals": [],
|
||||
"user": {
|
||||
"user_idname": {"pattern": ``, "strategy": "any"},
|
||||
"group_idnames": [{"pattern": ``, "strategy": "any"}],
|
||||
"umask": "0022"
|
||||
},
|
||||
"capabilities": {
|
||||
"bounding": ["CAP_SYS_ADMIN"],
|
||||
"effective": ["CAP_SYS_ADMIN"],
|
||||
"inheritable": ["CAP_SYS_ADMIN"],
|
||||
"permitted": ["CAP_SYS_ADMIN"],
|
||||
"ambient": ["CAP_SYS_ADMIN"],
|
||||
},
|
||||
"seccomp_profile_sha256": "",
|
||||
"allow_elevated": true,
|
||||
"working_dir": "/home/user",
|
||||
"allow_stdio_access": false,
|
||||
"no_new_privileges": true,
|
||||
},
|
||||
{
|
||||
"command": ["/pause"],
|
||||
"env_rules": [{"pattern": `PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin`, "strategy": "string", "required": true},{"pattern": `TERM=xterm`, "strategy": "string", "required": false}],
|
||||
"layers": ["16b514057a06ad665f92c02863aca074fd5976c755d26bff16365299169e8415"],
|
||||
"mounts": [],
|
||||
"exec_processes": [],
|
||||
"signals": [],
|
||||
"user": {
|
||||
"user_idname": {"pattern": ``, "strategy": "any"},
|
||||
"group_idnames": [{"pattern": ``, "strategy": "any"}],
|
||||
"umask": "0022"
|
||||
},
|
||||
"capabilities": null,
|
||||
"seccomp_profile_sha256": "",
|
||||
"allow_elevated": false,
|
||||
"working_dir": "/",
|
||||
"allow_stdio_access": false,
|
||||
"no_new_privileges": true,
|
||||
},
|
||||
]
|
||||
external_processes := [
|
||||
{"command": ["bash"], "env_rules": [{"pattern": `PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin`, "strategy": "string", "required": true}], "working_dir": "/", "allow_stdio_access": false},
|
||||
]
|
||||
allow_properties_access := false
|
||||
allow_dump_stacks := false
|
||||
allow_runtime_logging := false
|
||||
allow_environment_variable_dropping := false
|
||||
allow_unencrypted_scratch := false
|
||||
allow_capability_dropping := true
|
||||
|
||||
|
||||
mount_device := data.framework.mount_device
|
||||
unmount_device := data.framework.unmount_device
|
||||
mount_overlay := data.framework.mount_overlay
|
||||
unmount_overlay := data.framework.unmount_overlay
|
||||
create_container := data.framework.create_container
|
||||
exec_in_container := data.framework.exec_in_container
|
||||
exec_external := data.framework.exec_external
|
||||
shutdown_container := data.framework.shutdown_container
|
||||
signal_container_process := data.framework.signal_container_process
|
||||
plan9_mount := data.framework.plan9_mount
|
||||
plan9_unmount := data.framework.plan9_unmount
|
||||
get_properties := data.framework.get_properties
|
||||
dump_stacks := data.framework.dump_stacks
|
||||
runtime_logging := data.framework.runtime_logging
|
||||
load_fragment := data.framework.load_fragment
|
||||
scratch_mount := data.framework.scratch_mount
|
||||
scratch_unmount := data.framework.scratch_unmount
|
||||
reason := {
|
||||
"errors": data.framework.errors,
|
||||
"error_objects": data.framework.error_objects,
|
||||
}
|
||||
@@ -16,6 +16,7 @@ embeddedvirtualdoc
|
||||
evaltermexpr
|
||||
example
|
||||
fix1863
|
||||
indexing
|
||||
intersection
|
||||
invalidkeyerror
|
||||
jsonfilteridempotent
|
||||
@@ -26,6 +27,9 @@ objectremoveidempotent
|
||||
objectremovenonstringkey
|
||||
partialsetdoc
|
||||
rand
|
||||
regexisvalid
|
||||
regexmatch
|
||||
regexsplit
|
||||
replacen
|
||||
semvercompare
|
||||
sets
|
||||
@@ -35,8 +39,10 @@ trim
|
||||
trimleft
|
||||
trimprefix
|
||||
trimright
|
||||
trimspace
|
||||
trimsuffix
|
||||
typebuiltin
|
||||
typenamebuiltin
|
||||
undos
|
||||
union
|
||||
units
|
||||
+6
-1
@@ -121,7 +121,12 @@ fn run_opa_tests(opa_tests_dir: String, folders: &[String]) -> Result<()> {
|
||||
}
|
||||
(r, _) => {
|
||||
print!("\n{} failed.", case.note);
|
||||
dbg!((&case, &r));
|
||||
println!("{}", serde_yaml::to_string(&case)?);
|
||||
match &r {
|
||||
Ok(actual) => println!("GOT\n{}", serde_yaml::to_string(&actual)?),
|
||||
Err(e) => println!("ERROR: {e}"),
|
||||
}
|
||||
|
||||
if let Err(e) = r {
|
||||
let msg = e.to_string();
|
||||
let pat = "could not find function ";
|
||||
|
||||
Reference in New Issue
Block a user