mounts

Documentation

Index

• Constants
• Variables
• type Config
  • func (config *Config) GetSensitivePaths() []string
• type SensitivePathMounts
  • func New(config Config) *SensitivePathMounts
  • func (sensitive *SensitivePathMounts) Audit(resource k8stypes.Resource, _ []k8stypes.Resource) ([]*kubeaudit.AuditResult, error)

Constants

const (
	MountNameMetadataKey     = "MountName"
	MountPathMetadataKey     = "MountPath"
	MountReadOnlyMetadataKey = "MountReadOnly"
	MountVolumeNameKey       = "MountVolume"
	MountVolumeHostPathKey   = "MountVolumeHostPath"
)

const Name = "mounts"

const (
	// SensitivePathsMounted occurs when a container has sensitive host paths mounted
	SensitivePathsMounted = "SensitivePathsMounted"
)

Variables

var DefaultSensitivePaths = []string{"/proc", "/var/run/docker.sock", "/", "/etc", "/root", "/var/run/crio/crio.sock", "/home/admin", "/var/lib/kubelet", "/var/lib/kubelet/pki", "/etc/kubernetes", "/etc/kubernetes/manifests"}

DefaultSensitivePaths is the default list of sensitive mount paths (from Falco rule: https://github.com/falcosecurity/falco/blob/master/rules/k8s_audit_rules.yaml#L155)

Types

type Config

type Config struct {
	SensitivePaths []string `yaml:"denyPathsList"`
}

func (*Config) GetSensitivePaths

func (config *Config) GetSensitivePaths() []string

type SensitivePathMounts

type SensitivePathMounts struct {
	// contains filtered or unexported fields
}

SensitivePathMounts implements Auditable

func New

func New(config Config) *SensitivePathMounts

func (*SensitivePathMounts) Audit

func (sensitive *SensitivePathMounts) Audit(resource k8stypes.Resource, _ []k8stypes.Resource) ([]*kubeaudit.AuditResult, error)

Audit checks that the container does not have any sensitive host path