5gsec / nimbus Goto Github PK
View Code? Open in Web Editor NEWIntent driven security automation framework
License: Apache License 2.0
Intent driven security automation framework
License: Apache License 2.0
DS0032: Monitor for newly constructed containers that may deploy a container into an environment to facilitate execution or evade defenses.
Below is the list of possible Kyverno policies that can achieve this intent. The intent needs to pass parameters such as allowed image repositories, allowed base images, and so on.
Please review the policies once again to ensure that there is adequate coverage for this intent.
Kyverno Policy:
Allowed Image Repositories
Allowed Base Images
Advanced Restrict Image Registries
Block Stale Images
Check Image Base
Disallow Helm Tiller
Disallow latest tag
Disallow use of the SecurityContextConstraint (SCC) anyuid
Only trustworthy registries set root
Require Image Source
Require Image pull policy always - not needed if latest tag is not used
Require image pull secrets
Require images use checksums
Restrict image registries
P0
This will require a simple helm chart which installs the necessary resources
An adversary can piggyback user data within DNS requests, so that the DNS server retrieves the user data for further processing.
The detection technique involves logging the DNS requests
The adapter used is KubeArmor, and the API logging work [https://github.com//issues/112] item tracks the adapter/security engine work
This detection technique is not part of the MITRE FiGHT
More details needed here..
To prevent mounted docker socket: Kyverno has a policy - https://kyverno.io/policies/best-practices/disallow-cri-sock-mount/disallow-cri-sock-mount/
Ref:
https://github.com/DataDog/dirtypipe-container-breakout-poc
Techniques:
Techniques:
Intent is implemented by Kyverno adapter
Currently, nimbus is not doing anything wrt changes in SecurityIntent. So we need to handle following cases:
CREATE
UPDATE
DELETE
Seungsoo has already done some work with Caldera. Please check with him
We need to have a feature to match / exclude namespaces for a policy.
Design document - https://docs.google.com/document/d/1-zxAMBpX-ZdpmDTjS0qzmFk5pueOCtLaGa970KJLTNc/edit?usp=sharing
Use turnip for suspicious IP detection
This intent is fulfilled by dev2. So, we need an adapter to interface to dev2
Add integration tests for controllers in the core to verify the NimbusPolicy and ClusterNimbusPolicy generation.
Scenario: Create a SecurityIntent and a SecurityIntentBinding.
Expected outcomes:
An intermediary NimbusPolicy is generated with the expected values populated correctly.
The created SecurityIntent status subresource includes the ID and action fields with the intent values.
The created SecurityIntentBinding status subresource reflects the number and names of bound intents, along with the generated NimbusPolicy name.
Similar test cases for a SecurityIntent with a ClusterSecurityIntentBinding, expecting a ClusterNimbusPolicy generation.
Scenario: Modify a SecurityIntentBinding
Expected Outcome:
Scenario: Modify a NimbusPolicy
Expected Outcome:
Similar test cases for a ClusterSecurityIntentBinding with corresponding ClusterNimbusPolicy update.
Scenario: Delete a SecurityIntentBinding.
Expected Outcome:
Similar test case for a ClusterSecurityIntentBinding with corresponding ClusterNimbusPolicy deletion.
Protecting system folder; /tmp; this should take care of most of the attacks as the attack binaries are loaded into these folders
Do not allow binary execution from a list of folders.
The intent is implemented by the KubeArmor adapter
Data exfiltration can occur through malicious domain names
Using CiliumNetworkPolicy we can specify a fqdn whitelist as a CRD.
The destination DNS requests should be restricted to this whitelist
This fqdn whitelist could also be generated by the discovery engine
After successfully applying the SecurityIntent (SI) and SecurityIntentBinding (SIB), if we try to delete the SIB then nimbus crashes. However, SIB gets deleted from the k8s API server.
make run
go run pkg/nimbus-kubearmor/receiver/server/server.go
nimbus should not crash on the deletion of SIB.
Techniques:
Use cloud-api adapter and coco.
Ensure that DNS traffic is always forwarded to kube-dns-service
Techniques:
Nimbus logs error messages when we create, update or delete SIB, however, the resources including the NP get created, updated or deleted.
Some of these operations are hard to reproduce.
make run
kubectl apply -f examples/namespaced/pkg-mgr-exec-si-sib.yaml
and check logs
...
...
2024-02-14T21:40:37+05:30 ERROR failed to update NimbusPolicy {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "c2becafc-3fa9-4fdb-8574-040eec46dd38", "error": "NimbusPolicy.intent.security.nimbus.com \"pkg-mgr-execution-binding\" is invalid: spec.rules: Required value"}
github.com/5GSEC/nimbus/internal/controller.(*SecurityIntentBindingReconciler).Reconcile
/Users/anurag/workspace/nimbus/internal/controller/securityintentbinding_controller.go:99
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile
/Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:119
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler
/Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:316
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
/Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:266
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
/Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:227
2024-02-14T21:40:37+05:30 ERROR Reconciler error {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "c2becafc-3fa9-4fdb-8574-040eec46dd38", "error": "NimbusPolicy.intent.security.nimbus.com \"pkg-mgr-execution-binding\" is invalid: spec.rules: Required value"}
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler
/Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:329
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
/Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:266
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
/Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:227
2024-02-14T21:40:37+05:30 INFO SecurityIntentBinding not found. Ignoring since object must be deleted {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "e79a294b-e307-45db-a099-cdb27ccc7256"}
2024-02-14T21:40:37+05:30 INFO SecurityIntentBinding not found. Ignoring since object must be deleted {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "0efc000c-51e9-4394-ace0-961eaa515e18"}
2024-02-14T21:40:37+05:30 INFO SecurityIntentBinding not found. Ignoring since object must be deleted {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "d0ae5415-c5a2-41b9-8dc6-cfd821c6ece1"}
or
...
...
ERROR failed to update SecurityIntentBinding status after NimbusPolicy operation {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "034cc08c-708a-4bb9-b98f-50fcd627a875", "SecurityIntentBinding.Name": "pkg-mgr-execution-binding", "SecurityIntentBinding.Namespace": "default", "error": "Operation cannot be fulfilled on securityintentbindings.intent.security.nimbus.com \"pkg-mgr-execution-binding\": the object has been modified; please apply your changes to the latest version and try again"}
github.com/5GSEC/nimbus/internal/controller.(*SecurityIntentBindingReconciler).Reconcile
/Users/anurag/workspace/nimbus/internal/controller/securityintentbinding_controller.go:93
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile
/Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:119
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler
/Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:316
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
/Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:266
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
/Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:227
2024-02-14T21:50:44+05:30 ERROR Reconciler error {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "034cc08c-708a-4bb9-b98f-50fcd627a875", "error": "Operation cannot be fulfilled on securityintentbindings.intent.security.nimbus.com \"pkg-mgr-execution-binding\": the object has been modified; please apply your changes to the latest version and try again"}
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler
/Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:329
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
/Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:266
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
/Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:227
or sometimes you may get similar logs as follows:
...
...
2024-02-14T22:03:21+05:30 INFO SecurityIntentBinding not found. Ignoring since object must be deleted {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "8e5e0b5a-50c2-4fea-8f64-a0d01ccef662"}
2024-02-14T22:03:21+05:30 ERROR Failed to update SecurityIntentBinding after SI deletion/update {"controller": "securityintent", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntent", "SecurityIntent": {"name":"pkg-mgr-execution"}, "namespace": "", "name": "pkg-mgr-execution", "reconcileID": "b9c9b50b-601e-4e60-9a5e-a28311d9a495", "SecurityIntentBinding.Name": "pkg-mgr-execution-binding", "error": "Operation cannot be fulfilled on securityintentbindings.intent.security.nimbus.com \"pkg-mgr-execution-binding\": StorageError: invalid object, Code: 4, Key: /registry/intent.security.nimbus.com/securityintentbindings/default/pkg-mgr-execution-binding, ResourceVersion: 0, AdditionalErrorMsg: Precondition failed: UID in precondition: 3baceb47-0c84-48d4-9a46-efdfcb9c21b1, UID in object meta: "}
github.com/5GSEC/nimbus/internal/controller.(*SecurityIntentReconciler).updateRelatedSIBs
/Users/anurag/workspace/nimbus/internal/controller/securityintent_controller.go:113
github.com/5GSEC/nimbus/internal/controller.(*SecurityIntentReconciler).Reconcile
/Users/anurag/workspace/nimbus/internal/controller/securityintent_controller.go:39
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile
/Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:119
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler
/Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:316
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
/Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:266
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
/Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:227
2024-02-14T22:03:21+05:30 ERROR failed to update related SecurityIntentBindings after SI deletion {"controller": "securityintent", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntent", "SecurityIntent": {"name":"pkg-mgr-execution"}, "namespace": "", "name": "pkg-mgr-execution", "reconcileID": "b9c9b50b-601e-4e60-9a5e-a28311d9a495", "SecurityIntent.Name": "pkg-mgr-execution", "error": "Operation cannot be fulfilled on securityintentbindings.intent.security.nimbus.com \"pkg-mgr-execution-binding\": StorageError: invalid object, Code: 4, Key: /registry/intent.security.nimbus.com/securityintentbindings/default/pkg-mgr-execution-binding, ResourceVersion: 0, AdditionalErrorMsg: Precondition failed: UID in precondition: 3baceb47-0c84-48d4-9a46-efdfcb9c21b1, UID in object meta: "}
github.com/5GSEC/nimbus/internal/controller.(*SecurityIntentReconciler).Reconcile
/Users/anurag/workspace/nimbus/internal/controller/securityintent_controller.go:40
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile
/Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:119
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler
/Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:316
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
/Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:266
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
/Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:227
2024-02-14T22:03:21+05:30 ERROR Reconciler error {"controller": "securityintent", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntent", "SecurityIntent": {"name":"pkg-mgr-execution"}, "namespace": "", "name": "pkg-mgr-execution", "reconcileID": "b9c9b50b-601e-4e60-9a5e-a28311d9a495", "error": "Operation cannot be fulfilled on securityintentbindings.intent.security.nimbus.com \"pkg-mgr-execution-binding\": StorageError: invalid object, Code: 4, Key: /registry/intent.security.nimbus.com/securityintentbindings/default/pkg-mgr-execution-binding, ResourceVersion: 0, AdditionalErrorMsg: Precondition failed: UID in precondition: 3baceb47-0c84-48d4-9a46-efdfcb9c21b1, UID in object meta: "}
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler
/Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:329
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
/Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:266
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
/Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:227
2024-02-14T22:03:21+05:30 INFO SecurityIntent not found. Ignoring since object must be deleted {"controller": "securityintent", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntent", "SecurityIntent": {"name":"pkg-mgr-execution"}, "namespace": "", "name": "pkg-mgr-execution", "reconcileID": "f7e2d218-8325-4dff-aaeb-ac194531c58e"}
2024-02-14T22:03:21+05:30 INFO SecurityIntentBinding not found. Ignoring since object must be deleted {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "84467062-486d-4123-97f9-6a774e1a7618"}
Nimbus should not log error messages while performing create, update or delete operations on SIB or NP.
Generate zero-trust policies generated by the discovery engine based on application behaviour
The attacks that can be mitigated are:
Techniques:
Parameters need to be provided such which container is to be isolated
The adapters that are involved are:
KubeArmor, Network Policy, Service Mesh
If we specify the CEL expression to select resources in the SecurityIntentBinding (SIB) selector and if there is a typo or the resource itself doesn't exist in the cluster then nimbus crashes.
make run
kubectl apply -f examples/namespaced/cel-multi-si-sib-namespaced.yaml
labels["app"] == "nginx"
to labels["app"] == "ngin"
kubectl edit sib multiple-sis-nsscoped-binding
and then nimbus crashes with following logs:
...
2024-02-14T15:09:29+05:30 ERROR No labels matched the CEL expressions, aborting NimbusPolicy creation due to missing keys in labels {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"multiple-sis-nsscoped-binding","namespace":"default"}, "namespace": "default", "name": "multiple-sis-nsscoped-binding", "reconcileID": "01a3e488-1554-485a-ac60-23ce451636e6"}
github.com/5GSEC/nimbus/pkg/processor/policybuilder.BuildNimbusPolicy
/Users/anurag/workspace/nimbus/pkg/processor/policybuilder/nimbuspolicy_builder.go:76
github.com/5GSEC/nimbus/internal/controller.(*SecurityIntentBindingReconciler).Reconcile
/Users/anurag/workspace/nimbus/internal/controller/securityintentbinding_controller.go:66
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile
/Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:119
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler
/Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:316
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
/Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:266
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
/Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:227
2024-02-14T15:09:29+05:30 INFO Observed a panic in reconciler: runtime error: invalid memory address or nil pointer dereference {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"multiple-sis-nsscoped-binding","namespace":"default"}, "namespace": "default", "name": "multiple-sis-nsscoped-binding", "reconcileID": "01a3e488-1554-485a-ac60-23ce451636e6"}
panic: runtime error: invalid memory address or nil pointer dereference [recovered]
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x2 addr=0x78 pc=0x101b66904]
goroutine 125 [running]:
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile.func1()
/Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:116 +0x1a4
panic({0x101f9dc40?, 0x102ef3460?})
/opt/homebrew/opt/go/libexec/src/runtime/panic.go:914 +0x218
github.com/5GSEC/nimbus/internal/controller.(*SecurityIntentBindingReconciler).Reconcile(0x1400000fd28, {0x1021f81b0, 0x1400020ac60}, {{{0x140003283e0?, 0x5?}, {0x140006e6380?, 0x14000741cf8?}}})
/Users/anurag/workspace/nimbus/internal/controller/securityintentbinding_controller.go:81 +0x604
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile(0x1021fbe40?, {0x1021f81b0?, 0x1400020ac60?}, {{{0x140003283e0?, 0xb?}, {0x140006e6380?, 0x0?}}})
/Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:119 +0x8c
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler(0x140006a0500, {0x1021f81e8, 0x140004dbae0}, {0x102024000?, 0x140000ce6c0?})
/Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:316 +0x2e8
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem(0x140006a0500, {0x1021f81e8, 0x140004dbae0})
/Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:266 +0x16c
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2()
/Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:227 +0x74
created by sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2 in goroutine 77
/Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:223 +0x43c
exit status 2
make: *** [run] Error 1
Nimbus should handle gracefully scenarios where resources referenced in CEL expressions are either missing or contain typos.
Implemented by Kyverno Adapter
In the kyverno policy applied by default, OwnerReferences was empty, causing an index out of range error when trying to access the first element.
When trying to access kcp.OwnerReferences[0], the issue occurred because the OwnerReferences slice could be empty, but we tried to access it directly without checking.
k8tls enhancements for FIPS compliance are work item in the API Security Project
This Adapter will consume an intent - EnsureTLS - and create jobs to run the k8tls tool at periodic intervals to generate reports.
These reports will need to be accessed karmor CLI, and/or pushed to CNAPP
This work item needs review from the NSF team as jaehyun is also working on eBPF based monitoring of HTTP:
API Logging Intent can detect below techniques
One possible approach is
make run
kubectl apply -f examples/namespaced/pkg-mgr-exec-si-sib.yaml
2024-02-14T22:11:14+05:30 INFO setup Starting manager
2024-02-14T22:11:14+05:30 INFO starting server {"kind": "health probe", "addr": "[::]:8081"}
2024-02-14T22:11:14+05:30 INFO controller-runtime.metrics Starting metrics server
2024-02-14T22:11:14+05:30 INFO controller-runtime.metrics Serving metrics server {"bindAddress": ":8080", "secure": false}
2024-02-14T22:11:14+05:30 INFO Starting EventSource {"controller": "clustersecurityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "ClusterSecurityIntentBinding", "source": "kind source: *v1.ClusterSecurityIntentBinding"}
2024-02-14T22:11:14+05:30 INFO Starting EventSource {"controller": "securityintent", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntent", "source": "kind source: *v1.SecurityIntent"}
2024-02-14T22:11:14+05:30 INFO Starting Controller {"controller": "securityintent", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntent"}
2024-02-14T22:11:14+05:30 INFO Starting EventSource {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "source": "kind source: *v1.SecurityIntentBinding"}
2024-02-14T22:11:14+05:30 INFO Starting EventSource {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "source": "kind source: *v1.NimbusPolicy"}
2024-02-14T22:11:14+05:30 INFO Starting Controller {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding"}
2024-02-14T22:11:14+05:30 INFO Starting EventSource {"controller": "clustersecurityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "ClusterSecurityIntentBinding", "source": "kind source: *v1.ClusterNimbusPolicy"}
2024-02-14T22:11:14+05:30 INFO Starting Controller {"controller": "clustersecurityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "ClusterSecurityIntentBinding"}
2024-02-14T22:11:14+05:30 INFO Starting workers {"controller": "securityintent", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntent", "worker count": 1}
2024-02-14T22:11:14+05:30 INFO Starting workers {"controller": "clustersecurityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "ClusterSecurityIntentBinding", "worker count": 1}
2024-02-14T22:11:14+05:30 INFO Starting workers {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "worker count": 1}
2024-02-14T22:11:15+05:30 INFO SecurityIntent found {"controller": "securityintent", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntent", "SecurityIntent": {"name":"pkg-mgr-execution"}, "namespace": "", "name": "pkg-mgr-execution", "reconcileID": "e5c1170e-db26-4e1e-a828-4f0acbf5c29f", "SecurityIntent.Name": "pkg-mgr-execution"}
2024-02-14T22:11:15+05:30 INFO SecurityIntentBinding found {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "a5644e7c-d8b6-45cb-9b85-1b05f1f2eb23", "SecurityIntentBinding.Name": "pkg-mgr-execution-binding", "SecurityIntentBinding.Namespace": "default"}
2024-02-14T22:11:15+05:30 INFO SecurityIntent and SecurityIntentBinding matching started {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "9091fe05-4b4f-49c1-94e9-d5e720315ae4"}
2024-02-14T22:11:15+05:30 INFO Matching completed {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "9091fe05-4b4f-49c1-94e9-d5e720315ae4", "Matched SecurityIntents": ["pkg-mgr-execution"], "Matched SecurityIntentsBindings": ["pkg-mgr-execution-binding"]}
2024-02-14T22:11:15+05:30 INFO Building NimbusPolicy {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "9091fe05-4b4f-49c1-94e9-d5e720315ae4"}
2024-02-14T22:11:15+05:30 INFO NimbusPolicy built successfully {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "9091fe05-4b4f-49c1-94e9-d5e720315ae4", "Policy": {"namespace": "default", "name": "pkg-mgr-execution-binding"}}
2024-02-14T22:11:15+05:30 INFO NimbusPolicy created {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "9091fe05-4b4f-49c1-94e9-d5e720315ae4", "NimbusPolicy.Name": "pkg-mgr-execution-binding", "NimbusPolicy.Namespace": "default"}
2024-02-14T22:11:15+05:30 INFO NimbusPolicy created {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "9091fe05-4b4f-49c1-94e9-d5e720315ae4", "NimbusPolicy.Name": "pkg-mgr-execution-binding", "NimbusPolicy.Namespace": "default"}
2024-02-14T22:11:15+05:30 INFO SecurityIntent and SecurityIntentBinding matching started {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "a2411ff1-9788-4150-901d-bc12e45414d3"}
2024-02-14T22:11:15+05:30 INFO Matching completed {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "a2411ff1-9788-4150-901d-bc12e45414d3", "Matched SecurityIntents": ["pkg-mgr-execution"], "Matched SecurityIntentsBindings": ["pkg-mgr-execution-binding"]}
2024-02-14T22:11:15+05:30 INFO Building NimbusPolicy {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "a2411ff1-9788-4150-901d-bc12e45414d3"}
2024-02-14T22:11:15+05:30 INFO NimbusPolicy built successfully {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "a2411ff1-9788-4150-901d-bc12e45414d3", "Policy": {"namespace": "default", "name": "pkg-mgr-execution-binding"}}
2024-02-14T22:11:15+05:30 INFO NimbusPolicy created {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "a2411ff1-9788-4150-901d-bc12e45414d3", "NimbusPolicy.Name": "pkg-mgr-execution-binding", "NimbusPolicy.Namespace": "default"}
2024-02-14T22:11:15+05:30 INFO SecurityIntent and SecurityIntentBinding matching started {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "925c98ce-5c1e-46b3-9e4d-adb41fbed826"}
2024-02-14T22:11:15+05:30 INFO Matching completed {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "925c98ce-5c1e-46b3-9e4d-adb41fbed826", "Matched SecurityIntents": ["pkg-mgr-execution"], "Matched SecurityIntentsBindings": ["pkg-mgr-execution-binding"]}
2024-02-14T22:11:15+05:30 INFO Building NimbusPolicy {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "925c98ce-5c1e-46b3-9e4d-adb41fbed826"}
2024-02-14T22:11:15+05:30 INFO NimbusPolicy built successfully {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "925c98ce-5c1e-46b3-9e4d-adb41fbed826", "Policy": {"namespace": "default", "name": "pkg-mgr-execution-binding"}}
2024-02-14T22:11:15+05:30 INFO NimbusPolicy created {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "925c98ce-5c1e-46b3-9e4d-adb41fbed826", "NimbusPolicy.Name": "pkg-mgr-execution-binding", "NimbusPolicy.Namespace": "default"}
As we can see in above logs that we're getting duplicated entries for NimbusPolicy created
and then SecurityIntent and SecurityIntentBinding matching started
and the same chain logs are getting duplicated.
Nimbus should not log duplicate entries.
The following intents might be part of this:
More details needed here..
Mitigates these techniques
Implemented by the KubeArmor Adapter
M1051 is "Update Software Regularly". Virtual Patch is an intermediate step before the actual update.
There is a set of annotations (CVEs) on the pods
Nimbus can look at the CVEs, and then attempt a live patch on these pods to mitigate the CVE
As part of live patch, Also, Nimbus can also create NetPol in case of workloads exposed to Public INternet
Design Doc for the intent: https://docs.google.com/document/d/1Eui0kRgOtWK6dxFS7OceHrRS_CoA2mktIAb0oRvSZ5s/edit#heading=h.4t592l2u5hfg
Techniques:
Vulnerability Scanning
This is a pre-deployment requirements..
Only scanned images can be loaded..
Techniques:
Required.. PR is opened
Fix linting violations identified by golangci-lint, such as:
controllers/policy/network_policy.go:96:27: Error return value of `utils.ApplyOrUpdatePolicy` is not checked (errcheck)
utils.ApplyOrUpdatePolicy(ctx, c, policy, policy.Name)
^
controllers/policy/network_policy.go:87:6: func `createCiliumNetworkPolicy` is unused (unused)
func createCiliumNetworkPolicy(ctx context.Context, intent *intentv1.SecurityIntent) *ciliumv2.CiliumNetworkPolicy {
^
controllers/policy/network_policy.go:91:6: func `createKubeArmorNetworkPolicy` is unused (unused)
func createKubeArmorNetworkPolicy(ctx context.Context, intent *intentv1.SecurityIntent) *kubearmorpolicyv1.KubeArmorPolicy {
^
controllers/policy/network_policy.go:95:6: func `applyCiliumNetworkPolicy` is unused (unused)
func applyCiliumNetworkPolicy(ctx context.Context, c client.Client, policy *ciliumv2.CiliumNetworkPolicy) {
When the adapter policies are updated, add functionality for the adapters to reconcile.
We need to prepare bundles of intents based on Vertical - such as ORAN
https://docs.google.com/document/d/14ospxaiiXTcyZ47aWfUt0_OW9jbqc2xQmyM17Q1zp9A/edit
There are two work items here - Frontend, Backend.
This backlog item is for the backend. Subham is working on the frontend
Use a per-process capability list to prevent escape to Host
https://www.panoptica.app/research/7-ways-to-escape-a-container
DS0022: is a FIle data source.
Using this intent, following techniques are mitigated
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.