← Policy catalog
</> ValidatingAdmissionPolicy · Apache-2.0

Sets a Custom SELinux Role

initcontainer-selinux-role

severityModerate resourceInitContainers productKubernetes bundles2

A custom SELinux role label lets the init container transition into domains outside the confined container role, weakening the mandatory access control that keeps a compromised process away from host files and devices.

Rejects unless

!has(object.spec.initContainers) || object.spec.initContainers.all(ic,
  !has(ic.securityContext) ||
  !has(ic.securityContext.seLinuxOptions) ||
  !has(ic.securityContext.seLinuxOptions.role) ||
  ic.securityContext.seLinuxOptions.role == ""
)

spec.initContainers[*].securityContext.seLinuxOptions.role must be undefined or an empty string ("").

Remediation

Remove the seLinuxOptions.role setting from every init container or leave it as an empty string so the runtime assigns its default container role. Field: spec.initContainers[*].securityContext.seLinuxOptions.role.

Applies to

  • pods · v1 · CREATE, UPDATE

Manifest

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: initcontainer-selinux-role
  annotations:
    kubeapt.io/uuid: "32ff7e30-616c-43a7-92ae-44022ecc0da3"
    security.kubeapt.io/displayName: "Sets a Custom SELinux Role"
    security.kubeapt.io/description: "A custom SELinux role label lets the init container transition into domains outside the confined container role, weakening the mandatory access control that keeps a compromised process away from host files and devices."
    security.kubeapt.io/resource: "InitContainers"
    security.kubeapt.io/severity: "Moderate"
    security.kubeapt.io/remediation: "Remove the seLinuxOptions.role setting from every init container or leave it as an empty string so the runtime assigns its default container role. Field: spec.initContainers[*].securityContext.seLinuxOptions.role."
    security.kubeapt.io/product: "Kubernetes"
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
    - apiGroups:
      - ''
      apiVersions:
      - v1
      operations:
      - CREATE
      - UPDATE
      resources:
      - pods
  validations:
  - expression: |
      !has(object.spec.initContainers) || object.spec.initContainers.all(ic,
        !has(ic.securityContext) ||
        !has(ic.securityContext.seLinuxOptions) ||
        !has(ic.securityContext.seLinuxOptions.role) ||
        ic.securityContext.seLinuxOptions.role == ""
      )
    message: |
      spec.initContainers[*].securityContext.seLinuxOptions.role must be undefined or an empty string ("").

Save it as initcontainer-selinux-role.yaml — the commands below assume that name.

Validate with kubeapt

Check a workload against this one policy, before anything is installed on a cluster.

$ kubeapt validate -p ./initcontainer-selinux-role.yaml -r ./workload.yaml

Or without the file, from the published policy set — -r takes a directory too:

$ kubeapt policies download && kubeapt validate --policy-name initcontainer-selinux-role -r ./manifests

Or against every namespace in the cluster your kubeconfig points at:

$ kubeapt validate --policy-name initcontainer-selinux-role -A

Bundles

Source

View policy.yaml on GitHub →