Add a new command to audit runAsUser fields (#316)

auditors/nonroot/fix.go

@@ -19,6 +19,11 @@ func (f *fixRunAsNonRoot) Apply(resource k8stypes.Resource) []k8stypes.Resource
 	if f.container.SecurityContext == nil {
 		f.container.SecurityContext = &k8stypes.SecurityContextV1{}
 	}
+
+	if f.container.SecurityContext.RunAsUser != nil && *f.container.SecurityContext.RunAsUser == 0 {
+		f.container.SecurityContext.RunAsUser = nil
+	}
+
 	f.container.SecurityContext.RunAsNonRoot = k8s.NewTrue()
 	return nil
 }

auditors/nonroot/fix_test.go

@@ -27,6 +27,27 @@ func TestFixRunAsNonRoot(t *testing.T) {
 		{"run-as-non-root-psc-false-csc-nil-multiple-cont.yml", fixtureDir, k8s.NewTrue()},
 		{"run-as-non-root-psc-false-csc-true-multiple-cont.yml", fixtureDir, k8s.NewTrue()},
 		{"run-as-non-root-psc-false-allowed-multi-containers-single-label.yml", fixtureDir, k8s.NewTrue()},
+		{"run-as-user-0.yml", fixtureDir, k8s.NewTrue()},
+		{"run-as-user-0-allowed.yml", fixtureDir, nil},
+		{"run-as-user-psc-0.yml", fixtureDir, k8s.NewTrue()},
+		{"run-as-user-psc-0-allowed.yml", fixtureDir, nil},
+		{"run-as-user-psc-1.yml", fixtureDir, nil},
+		{"run-as-user-psc-1-csc-0.yml", fixtureDir, k8s.NewTrue()},
+		{"run-as-user-psc-0-csc-0.yml", fixtureDir, k8s.NewTrue()},
+		{"run-as-user-psc-0-csc-1.yml", fixtureDir, nil},
+		{"run-as-user-redundant-override-container.yml", fixtureDir, nil},
+		{"run-as-user-redundant-override-pod.yml", fixtureDir, nil},
+		{"run-as-user-psc-0-csc-1-multiple-cont.yml", fixtureDir, nil},
+		{"run-as-user-psc-0-allowed-multi-containers-multi-labels.yml", fixtureDir, nil},
+		{"run-as-user-psc-0-allowed-multi-containers-single-label.yml", fixtureDir, nil},
+		{"run-as-user-0-run-as-non-root-true.yml", fixtureDir, k8s.NewTrue()},
+		{"run-as-user-0-run-as-non-root-false.yml", fixtureDir, k8s.NewTrue()},
+		{"run-as-user-psc-0-run-as-non-root-psc-true.yml", fixtureDir, k8s.NewTrue()},
+		{"run-as-user-psc-0-run-as-non-root-psc-false.yml", fixtureDir, k8s.NewTrue()},
+		{"run-as-user-1-run-as-non-root-true.yml", fixtureDir, k8s.NewTrue()},
+		{"run-as-user-1-run-as-non-root-false.yml", fixtureDir, k8s.NewFalse()},
+		{"run-as-user-psc-1-run-as-non-root-psc-true.yml", fixtureDir, nil},
+		{"run-as-user-psc-1-run-as-non-root-psc-false.yml", fixtureDir, nil},
 	}
 
 	for _, tc := range cases {
@@ -45,19 +66,24 @@ func TestFixRunAsNonRoot(t *testing.T) {
 		})
 	}
 
-	file := "run-as-non-root-psc-false-allowed-multi-containers-multi-labels.yml"
-	t.Run(file, func(t *testing.T) {
-		resources, _ := test.FixSetup(t, fixtureDir, file, New())
-		for _, resource := range resources {
-			containers := k8s.GetContainers(resource)
-			for _, container := range containers {
-				switch container.Name {
-				case "fakeContainerRANR":
-					assert.True(t, (container.SecurityContext == nil || container.SecurityContext.RunAsNonRoot == nil))
-				case "fakeContainerRANR2":
-					assert.True(t, *container.SecurityContext.RunAsNonRoot)
+	files := []string {
+		"run-as-non-root-psc-false-allowed-multi-containers-multi-labels.yml",
+		"run-as-user-psc-0-csc-nil-multiple-cont.yml",
+	}
+	for _, file := range files {
+		t.Run(file, func(t *testing.T) {
+			resources, _ := test.FixSetup(t, fixtureDir, file, New())
+			for _, resource := range resources {
+				containers := k8s.GetContainers(resource)
+				for _, container := range containers {
+					switch container.Name {
+					case "container1":
+						assert.True(t, (container.SecurityContext == nil || container.SecurityContext.RunAsNonRoot == nil))
+					case "container2":
+						assert.True(t, *container.SecurityContext.RunAsNonRoot)
+					}
 				}
 			}
-		}
-	})
+		})
+	}
 }

auditors/nonroot/fixtures/run-as-user-0-allowed.yml

@@ -0,0 +1,21 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: deployment
+  namespace: run-as-user-0-allowed
+spec:
+  selector:
+    matchLabels:
+      name: deployment
+  template:
+    metadata:
+      labels:
+        name: deployment
+        audit.kubernetes.io/pod.allow-run-as-root: "SuperuserPrivilegesNeeded"
+    spec:
+      containers:
+        - name: container
+          image: scratch
+          securityContext:
+            runAsUser: 0

auditors/nonroot/fixtures/run-as-user-0-run-as-non-root-false.yml

@@ -0,0 +1,20 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: deployment
+  namespace: run-as-user-0-run-as-non-root-false
+spec:
+  selector:
+    matchLabels:
+      name: deployment
+  template:
+    metadata:
+      labels:
+        name: deployment
+    spec:
+      containers:
+        - name: container
+          image: scratch
+          securityContext:
+            runAsUser: 0
+            runAsNonRoot: false

auditors/nonroot/fixtures/run-as-user-0-run-as-non-root-true.yml

@@ -0,0 +1,20 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: deployment
+  namespace: run-as-user-0-run-as-non-root-true
+spec:
+  selector:
+    matchLabels:
+      name: deployment
+  template:
+    metadata:
+      labels:
+        name: deployment
+    spec:
+      containers:
+        - name: container
+          image: scratch
+          securityContext:
+            runAsUser: 0
+            runAsNonRoot: true

auditors/nonroot/fixtures/run-as-user-0.yml

@@ -0,0 +1,19 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: deployment
+  namespace: run-as-user-0
+spec:
+  selector:
+    matchLabels:
+      name: deployment
+  template:
+    metadata:
+      labels:
+        name: deployment
+    spec:
+      containers:
+        - name: container
+          image: scratch
+          securityContext:
+            runAsUser: 0

auditors/nonroot/fixtures/run-as-user-1-run-as-non-root-false.yml

@@ -0,0 +1,20 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: deployment
+  namespace: run-as-user-1-run-as-non-root-false
+spec:
+  selector:
+    matchLabels:
+      name: deployment
+  template:
+    metadata:
+      labels:
+        name: deployment
+    spec:
+      containers:
+        - name: container
+          image: scratch
+          securityContext:
+            runAsUser: 1
+            runAsNonRoot: false

auditors/nonroot/fixtures/run-as-user-1-run-as-non-root-true.yml

@@ -0,0 +1,20 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: deployment
+  namespace: run-as-user-1-run-as-non-root-true
+spec:
+  selector:
+    matchLabels:
+      name: deployment
+  template:
+    metadata:
+      labels:
+        name: deployment
+    spec:
+      containers:
+        - name: container
+          image: scratch
+          securityContext:
+            runAsUser: 1
+            runAsNonRoot: true

auditors/nonroot/fixtures/run-as-user-psc-0-allowed-multi-containers-multi-labels.yml

@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: pod
+  labels:
+    name: pod
+    container.audit.kubernetes.io/container1.allow-run-as-root: "SuperuserPrivilegesNeeded"
+    container.audit.kubernetes.io/container2.allow-run-as-root: "SuperuserPrivilegesNeeded"
+  namespace: run-as-user-psc-0-allowed-multi-containers-multi-labels
+spec:
+  securityContext:
+    runAsUser: 0
+  containers:
+    - name: container1
+      image: scratch
+    - name: container2
+      image: scratch
+      securityContext:
+        runAsUser: 1

auditors/nonroot/fixtures/run-as-user-psc-0-allowed-multi-containers-single-label.yml

@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: pod
+  labels:
+    name: pod
+    container.audit.kubernetes.io/container2.allow-run-as-root: "SuperuserPrivilegesNeeded"
+  namespace: run-as-user-psc-0-allowed-multi-containers-single-label
+spec:
+  securityContext:
+    runAsUser: 0
+  containers:
+    - name: container1
+      image: scratch
+      securityContext:
+        runAsUser: 1
+    - name: container2
+      image: scratch
+      securityContext:
+        runAsUser: 0

auditors/nonroot/fixtures/run-as-user-psc-0-allowed.yml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: pod
+  labels:
+    name: pod
+    audit.kubernetes.io/pod.allow-run-as-root: "SuperuserPrivilegesNeeded"
+  namespace: run-as-user-psc-0-allowed
+spec:
+  securityContext:
+    runAsUser: 0
+  containers:
+    - name: container
+      image: scratch

auditors/nonroot/fixtures/run-as-user-psc-0-csc-0.yml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: pod
+  namespace: run-as-user-psc-0-csc-0
+spec:
+  securityContext:
+    runAsUser: 0
+  containers:
+    - name: container
+      image: scratch
+      securityContext:
+        runAsUser: 0

auditors/nonroot/fixtures/run-as-user-psc-0-csc-1-multiple-cont.yml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: pod
+  namespace: run-as-user-psc-0-csc-1-multiple-cont
+spec:
+  securityContext:
+    runAsUser: 0
+  containers:
+    - name: container1
+      image: scratch
+      securityContext:
+        runAsUser: 1
+    - name: container2
+      image: scratch
+      securityContext:
+        runAsUser: 1

auditors/nonroot/fixtures/run-as-user-psc-0-csc-1.yml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: pod
+  namespace: run-as-user-psc-0-csc-1
+spec:
+  securityContext:
+    runAsUser: 0
+  containers:
+    - name: container
+      image: scratch
+      securityContext:
+        runAsUser: 1

auditors/nonroot/fixtures/run-as-user-psc-0-csc-nil-multiple-cont.yml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: pod
+  namespace: run-as-user-psc-0-csc-nil-multiple-cont
+spec:
+  securityContext:
+    runAsUser: 0
+  containers:
+    - name: container1
+      image: scratch
+      securityContext:
+        runAsUser: 1
+    - name: container2
+      image: scratch

auditors/nonroot/fixtures/run-as-user-psc-0-run-as-non-root-psc-false.yml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: pod
+  labels:
+    name: pod
+  namespace: run-as-user-psc-0-run-as-non-root-psc-false
+spec:
+  securityContext:
+    runAsUser: 0
+    runAsNonRoot: false
+  containers:
+    - name: container
+      image: scratch

auditors/nonroot/fixtures/run-as-user-psc-0-run-as-non-root-psc-true.yml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: pod
+  labels:
+    name: pod
+  namespace: run-as-user-psc-0-run-as-non-root-psc-true
+spec:
+  securityContext:
+    runAsUser: 0
+    runAsNonRoot: true
+  containers:
+    - name: container
+      image: scratch

auditors/nonroot/fixtures/run-as-user-psc-0.yml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: pod
+  labels:
+    name: pod
+  namespace: run-as-user-psc-0
+spec:
+  securityContext:
+    runAsUser: 0
+  containers:
+    - name: container
+      image: scratch

auditors/nonroot/fixtures/run-as-user-psc-1-csc-0.yml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: pod
+  namespace: run-as-user-psc-1-csc-0
+spec:
+  securityContext:
+    runAsUser: 1
+  containers:
+    - name: container
+      image: scratch
+      securityContext:
+        runAsUser: 0

auditors/nonroot/fixtures/run-as-user-psc-1-run-as-non-root-psc-false.yml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: pod
+  labels:
+    name: pod
+  namespace: run-as-user-psc-1-run-as-non-root-psc-false
+spec:
+  securityContext:
+    runAsUser: 1
+    runAsNonRoot: false
+  containers:
+    - name: container
+      image: scratch