Feature/security context

src/confcom/.gitignore

@@ -27,6 +27,13 @@ azext_confcom/bin/
 azext_confcom/bin/*
 **/dmverity-vhd.exe
 **/dmverity-vhd
+
 # metadata file for coverage reports
 **/.coverage
-**/htmlcov
+**/htmlcov
+
+# temporary files
+azext_confcom/data/svn_api
+azext_confcom/data/svn_framework
+**/svn_api
+**/svn_framework

src/confcom/HISTORY.rst

@@ -2,6 +2,18 @@
 
 Release History
 ===============
+0.2.14
+* updating svn_framework version
+* updating capabilities defaults to be based on allow_elevated and privileged values
+* adding capabilities into pause container
+
+0.2.13
+* adding parsing of container security context field in ARM template
+* changing hardcoded API_SVN and FRAMEWORK_SVN to get values from HCSSHIM repo
+* bumping HCSSHIM version
+* fixing bug where you could not pull by sha value if a tag was not specified
+* fixing error message when attempting to use sha value with tar files
+
 0.2.12
 * adding ability for mixed-mode OCI image pulling, e.g. using tar files and remote registries in the same template
 * adding option to use allow-all regex for environment variables

src/confcom/azext_confcom/_params.py

@@ -95,7 +95,7 @@ def load_arguments(self, _):
             help="Validate that the image used to generate the CCE Policy for a sidecar container will be allowed by its generated policy",
         )
         c.argument(
-            "print-existing-policy",
+            "print_existing_policy",
             options_list=("--print-existing-policy"),
             required=False,
             action="store_true",

src/confcom/azext_confcom/config.py

@@ -25,6 +25,11 @@
 ACI_FIELD_CONTAINERS_MOUNTS_READONLY = "readonly"
 ACI_FIELD_CONTAINERS_WAIT_MOUNT_POINTS = "wait_mount_points"
 ACI_FIELD_CONTAINERS_ALLOW_ELEVATED = "allow_elevated"
+ACI_FIELD_CONTAINERS_SECURITY_CONTEXT = "securityContext"
+ACI_FIELD_CONTAINERS_ALLOW_PRIVILEGE_ESCALATION = "allowPrivilegeEscalation"
+ACI_FIELD_CONTAINERS_RUN_AS_USER = "runAsUser"
+ACI_FIELD_CONTAINERS_RUN_AS_GROUP = "runAsGroup"
+ACI_FIELD_CONTAINERS_SECCOMP_PROFILE = "seccompProfile"
 ACI_FIELD_CONTAINERS_REGO_FRAGMENTS = "fragments"
 ACI_FIELD_CONTAINERS_REGO_FRAGMENTS_FEED = "feed"
 ACI_FIELD_CONTAINERS_REGO_FRAGMENTS_ISS = "iss"
@@ -51,6 +56,7 @@
 ACI_FIELD_TEMPLATE_VARIABLES = "variables"
 ACI_FIELD_TEMPLATE_VOLUMES = "volumes"
 ACI_FIELD_TEMPLATE_IMAGE = "image"
+ACI_FIELD_TEMPLATE_SECURITY_CONTEXT = "securityContext"
 ACI_FIELD_TEMPLATE_RESOURCE_LABEL = "Microsoft.ContainerInstance/containerGroups"
 ACI_FIELD_TEMPLATE_COMMAND = "command"
 ACI_FIELD_TEMPLATE_ENVS = "environmentVariables"
@@ -60,6 +66,10 @@
 ACI_FIELD_TEMPLATE_MOUNTS_READONLY = "readOnly"
 ACI_FIELD_TEMPLATE_CONFCOM_PROPERTIES = "confidentialComputeProperties"
 ACI_FIELD_TEMPLATE_CCE_POLICY = "ccePolicy"
+ACI_FIELD_CONTAINERS_PRIVILEGED = "privileged"
+ACI_FIELD_CONTAINERS_CAPABILITIES = "capabilities"
+ACI_FIELD_CONTAINERS_CAPABILITIES_ADD = "add"
+ACI_FIELD_CONTAINERS_CAPABILITIES_DROP = "drop"
 
 
 # output json values
@@ -84,9 +94,23 @@
 POLICY_FIELD_CONTAINERS_ELEMENTS_MOUNTS_OPTIONS = "options"
 POLICY_FIELD_CONTAINERS_ELEMENTS_WAIT_MOUNT_POINTS = "wait_mount_points"
 POLICY_FIELD_CONTAINERS_ELEMENTS_ALLOW_ELEVATED = "allow_elevated"
-POLICY_FIELD_CONTAINER_EXEC_PROCESSES = "exec_processes"
-POLICY_FIELD_CONTAINER_SIGNAL_CONTAINER_PROCESSES = "signals"
-POLICY_FIELD_CONTAINERS_ALLOW_STDIO_ACCESS = "allow_stdio_access"
+POLICY_FIELD_CONTAINERS_ELEMENTS_NO_NEW_PRIVILEGES = "no_new_privileges"
+POLICY_FIELD_CONTAINERS_ELEMENTS_EXEC_PROCESSES = "exec_processes"
+POLICY_FIELD_CONTAINERS_ELEMENTS_SIGNAL_CONTAINER_PROCESSES = "signals"
+POLICY_FIELD_CONTAINERS_ELEMENTS_USER = "user"
+POLICY_FIELD_CONTAINERS_ELEMENTS_USER_USER_IDNAME = "user_idname"
+POLICY_FIELD_CONTAINERS_ELEMENTS_USER_GROUP_IDNAMES = "group_idnames"
+POLICY_FIELD_CONTAINERS_ELEMENTS_USER_UMASK = "umask"
+POLICY_FIELD_CONTAINERS_ELEMENTS_USER_PATTERN = "pattern"
+POLICY_FIELD_CONTAINERS_ELEMENTS_CAPABILITIES = "capabilities"
+POLICY_FIELD_CONTAINERS_ELEMENTS_CAPABILITIES_BOUNDING = "bounding"
+POLICY_FIELD_CONTAINERS_ELEMENTS_CAPABILITIES_EFFECTIVE = "effective"
+POLICY_FIELD_CONTAINERS_ELEMENTS_CAPABILITIES_INHERITABLE = "inheritable"
+POLICY_FIELD_CONTAINERS_ELEMENTS_CAPABILITIES_PERMITTED = "permitted"
+POLICY_FIELD_CONTAINERS_ELEMENTS_CAPABILITIES_AMBIENT = "ambient"
+POLICY_FIELD_CONTAINERS_ELEMENTS_USER_STRATEGY = "strategy"
+POLICY_FIELD_CONTAINERS_ELEMENTS_SECCOMP_PROFILE_SHA256 = "seccomp_profile_sha256"
+POLICY_FIELD_CONTAINERS_ELEMENTS_ALLOW_STDIO_ACCESS = "allow_stdio_access"
 POLICY_FIELD_CONTAINERS_ELEMENTS_REGO_FRAGMENTS = "fragments"
 POLICY_FIELD_CONTAINERS_ELEMENTS_REGO_FRAGMENTS_FEED = "feed"
 POLICY_FIELD_CONTAINERS_ELEMENTS_REGO_FRAGMENTS_ISS = "iss"
@@ -132,5 +156,19 @@
 SIDECAR_REGO_FILE = "./data/sidecar_rego_policy.txt"
 SIDECAR_REGO_FILE_PATH = f"{script_directory}/{SIDECAR_REGO_FILE}"
 SIDECAR_REGO_POLICY = os_util.load_str_from_file(SIDECAR_REGO_FILE_PATH)
+# framework svn file
+SVN_FRAMEWORK_FILE = "./data/svn_framework"
+SVN_FRAMEWORK_PATH = f"{script_directory}/{SVN_FRAMEWORK_FILE}"
+SVN_FRAMEWORK_VERSION = os_util.load_str_from_file(SVN_FRAMEWORK_PATH)
+# api svn file
+SVN_API_FILE = "./data/svn_api"
+SVN_API_PATH = f"{script_directory}/{SVN_API_FILE}"
+SVN_API_VERSION = os_util.load_str_from_file(SVN_API_PATH)
 # default containers to be added to all container groups
 DEFAULT_CONTAINERS = _config["default_containers"]
+# default container user config to be added for security context
+DEFAULT_USER = _config["default_user"]
+# default unpriviliged user capabilities to be added for security context
+DEFAULT_UNPRIVILEGED_CAPABILITIES = _config["default_unprivileged_capabilities"]
+# default priviliged user capabilities to be added for security context
+DEFAULT_PRIVILEGED_CAPABILITIES = _config["default_privileged_capabilities"]