SecurityPolicy: Add leading and trailing checks for env variables

pkg/securitypolicy/framework.rego

@@ -144,7 +144,30 @@ env_ok(pattern, "string", value) {
 }
 
 env_ok(pattern, "re2", value) {
-    regex.match(pattern, value)
+    anchored := anchor_pattern(pattern)
+    regex.match(anchored, value)
+}
+
+anchor_pattern(p) := anchored {
+    startswith_leading := startswith(p, "^")
+    endswith_trailing := endswith(p, "$")
+
+    anchored = sprintf("%s%s%s", [
+        add_leading_trailing_chars(startswith_leading, "", "^"),  # Add ^ only if missing
+        p,
+        add_leading_trailing_chars(endswith_trailing, "", "$")     # Add $ only if missing
+    ])
+}
+
+# Function to return one of two values depending on a boolean condition
+add_leading_trailing_chars(cond, ifTrue, ifFalse) := result {
+    cond
+    result = ifTrue
+}
+
+add_leading_trailing_chars(cond, ifTrue, ifFalse) := result {
+    not cond
+    result = ifFalse
 }
 
 rule_ok(rule, env) {

pkg/securitypolicy/regopolicy_test.go

@@ -721,15 +721,21 @@ func Test_Rego_EnforceEnvironmentVariablePolicy_Re2Match(t *testing.T) {
 			Rule:     "PREFIX_.+=.+",
 		}
 
-		container.EnvRules = append(container.EnvRules, re2MatchRule)
+		// it must pass even if there is leading ^ and trailing $ in the rule
+		re2MatchPrefix := EnvRuleConfig{
+			Strategy: EnvVarRuleRegex,
+			Rule:     "^LEAD_.+=.+_TRAIL$",
+		}
+
+		container.EnvRules = append(container.EnvRules, re2MatchRule, re2MatchPrefix)
 
 		tc, err := setupRegoCreateContainerTest(gc, container, false)
 		if err != nil {
 			t.Error(err)
 			return false
 		}
 
-		envList := append(tc.envList, "PREFIX_FOO=BAR")
+		envList := append(tc.envList, "PREFIX_FOO=BAR", "LEAD_FOO=BAR_TRAIL")
 		_, _, _, err = tc.policy.EnforceCreateContainerPolicy(gc.ctx, tc.sandboxID, tc.containerID, tc.argList, envList, tc.workingDir, tc.mounts, false, tc.noNewPrivileges, tc.user, tc.groups, tc.umask, tc.capabilities, tc.seccomp)
 
 		// getting an error means something is broken
@@ -746,6 +752,39 @@ func Test_Rego_EnforceEnvironmentVariablePolicy_Re2Match(t *testing.T) {
 	}
 }
 
+func Test_Rego_EnforceEnvironmentVariablePolicy_Re2MisMatch(t *testing.T) {
+	testFunc := func(gc *generatedConstraints) bool {
+		container := selectContainerFromContainerList(gc.containers, testRand)
+		// add a rule to re2 match
+		re2MatchRule := EnvRuleConfig{
+			Strategy: EnvVarRuleRegex,
+			Rule:     "PREFIX_.+=.+BAR$",
+		}
+
+		container.EnvRules = append(container.EnvRules, re2MatchRule)
+
+		tc, err := setupRegoCreateContainerTest(gc, container, false)
+		if err != nil {
+			t.Error(err)
+			return false
+		}
+
+		envList := append(tc.envList, "PREFIX_FOO=BAR_FOO")
+		_, _, _, err = tc.policy.EnforceCreateContainerPolicy(gc.ctx, tc.sandboxID, tc.containerID, tc.argList, envList, tc.workingDir, tc.mounts, false, tc.noNewPrivileges, tc.user, tc.groups, tc.umask, tc.capabilities, tc.seccomp)
+
+		// not getting an error means something is broken
+		if err == nil {
+			return false
+		}
+
+		return assertDecisionJSONContains(t, err, "invalid env list", "PREFIX_FOO")
+	}
+
+	if err := quick.Check(testFunc, &quick.Config{MaxCount: 50, Rand: testRand}); err != nil {
+		t.Errorf("Test_Rego_EnforceEnvironmentVariablePolicy_Re2Match: %v", err)
+	}
+}
+
 func Test_Rego_EnforceEnvironmentVariablePolicy_NotAllMatches(t *testing.T) {
 	f := func(p *generatedConstraints) bool {
 		tc, err := setupSimpleRegoCreateContainerTest(p)

pkg/securitypolicy/securitypolicy_test.go

@@ -1206,8 +1206,11 @@ func buildEnvironmentVariablesFromEnvRules(rules []EnvRuleConfig, r *rand.Rand)
 	// Build in all required rules, this isn't a setup method of "missing item"
 	// tests
 	for _, rule := range rules {
+
 		if rule.Required {
-			vars = append(vars, rule.Rule)
+			if rule.Strategy != EnvVarRuleRegex {
+				vars = append(vars, rule.Rule)
+			}
 			numberOfMatches--
 		}
 	}
@@ -1234,10 +1237,13 @@ func buildEnvironmentVariablesFromEnvRules(rules []EnvRuleConfig, r *rand.Rand)
 			}
 		}
 
-		vars = append(vars, rules[anIndex].Rule)
-		usedIndexes[anIndex] = struct{}{}
-
+		// include it if it's not regex
+		if rules[anIndex].Strategy != EnvVarRuleRegex {
+			vars = append(vars, rules[anIndex].Rule)
+			usedIndexes[anIndex] = struct{}{}
+		}
 		numberOfMatches--
+
 	}
 
 	return vars