Skip to content

Commit

Permalink
clean up code
Browse files Browse the repository at this point in the history 
Signed-off-by: kaizhe <derek0405@gmail.com>
  • Loading branch information
@Kaizhe
Kaizhe committed Feb 6, 2020
1 parent 16a5392 commit a17acbc
Show file tree
Hide file tree
Showing 11 changed files with 146 additions and 133 deletions.
136 changes: 60 additions & 76 deletions advisor/types/escalation.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,8 @@ const (
type EscalationReport struct {
TotalSourceWorkloads int `json:"total_source_workloads"`
TotalTargetWorkloads int `json:"total_target_workloads"`
TotalSourceImages int `json:"total_source_images"`
TotalTargetImages int `json:"total_target_images"`
TotalEscalation int `json:"escalation_count"`
TotalReduction int `json:"reduction_count"`
Escalations []Metadata `json:"escalations"`
Expand Down Expand Up @@ -62,6 +64,7 @@ type Escalation struct {
workloadMap map[Metadata]bool `json:"-"`
}

// InitEscalation returns an initialized escalation object
func InitEscalation(status int, prev, cur string) *Escalation {
return &Escalation{
Status: status,
Expand All @@ -73,6 +76,7 @@ func InitEscalation(status int, prev, cur string) *Escalation {
}
}

// SetEscalation set escalation status
func (e *Escalation) SetEscalation(status int, prev, cur string) {
e.Status = status
e.StatusMessage = getEscalatedStatus(status)
Expand All @@ -88,6 +92,21 @@ func (e *Escalation) AddWorkload(w Metadata) {
e.workloadMap[w] = true
}

func (e *Escalation) ConsolidateWorkloadImage() {
m := map[Metadata]bool{}

for w := range e.workloadMap {
w.Image = ""
m[w] = true
}

for w := range m {
e.Workloads = append(e.Workloads, w)
}

e.WorkloadCount = len(e.Workloads)
}

func (e *Escalation) ConsolidateWorkload() {
for w := range e.workloadMap {
e.Workloads = append(e.Workloads, w)
Expand All @@ -108,6 +127,7 @@ func (e *Escalation) IsReduced() bool {
return e.Status == Reduced && e.UseSecurityContext()
}

// NewEscalationReport returns an escalation report object
func NewEscalationReport() *EscalationReport {
return &EscalationReport{
TotalSourceWorkloads: 0,
Expand Down Expand Up @@ -139,108 +159,133 @@ func NewEscalationReport() *EscalationReport {
}
}

func (er *EscalationReport) PrivilegeEscalated() bool {
// privileged mode
func (er *EscalationReport) PrivilegedEscalated() bool {
return er.NewPrivileged.IsEscalated()
}

func (er *EscalationReport) PrivilegeReduced() bool {
// privileged mode
func (er *EscalationReport) PrivilegedReduced() bool {
return er.RemovedPrivileged.IsReduced()
}

func (er *EscalationReport) PrivilegeNoChange() bool {
return !er.PrivilegeReduced() && !er.PrivilegeReduced()
// privileged mode
func (er *EscalationReport) PrivilegedNoChange() bool {
return !er.PrivilegedReduced() && !er.PrivilegedReduced()
}

// HostIPC
func (er *EscalationReport) HostIPCEscalated() bool {
return er.NewHostIPC.IsEscalated()
}

// HostIPC
func (er *EscalationReport) HostIPCReduced() bool {
return er.RemovedHostIPC.IsReduced()
}

// HostIPC
func (er *EscalationReport) HostIPCNoChange() bool {
return !er.HostIPCEscalated() && !er.HostIPCReduced()
}

// HostNetwork
func (er *EscalationReport) HostNetworkEscalated() bool {
return er.NewHostNetwork.IsEscalated()
}

// HostNetwork
func (er *EscalationReport) HostNetworkReduced() bool {
return er.RemovedHostNetwork.IsReduced()
}

// HostNetwork
func (er *EscalationReport) HostNetworkNoChange() bool {
return !er.HostNetworkEscalated() && !er.HostNetworkReduced()
}

// HostPID
func (er *EscalationReport) HostPIDEscalated() bool {
return er.NewHostPID.IsEscalated()
}

// HostPID
func (er *EscalationReport) HostPIDReduced() bool {
return er.RemovedHostPID.IsReduced()
}

// HostPID
func (er *EscalationReport) HostPIDNoChange() bool {
return !er.HostPIDEscalated() && !er.HostPIDReduced()
}

// ReadOnlyRootFileSystem
func (er *EscalationReport) ReadOnlyRootFSEscalated() bool {
return er.RemovedReadOnlyRootFS.IsEscalated()
}

// ReadOnlyRootFileSystem
func (er *EscalationReport) ReadOnlyRootFSReduced() bool {
return er.NewReadOnlyRootFS.IsReduced()
}

// ReadOnlyRootFileSystem
func (er *EscalationReport) ReadOnlyRootFSNoChange() bool {
return !er.ReadOnlyRootFSEscalated() && !er.ReadOnlyRootFSReduced()
}

// runAsUser (non root -> root)
func (er *EscalationReport) RunUserAsRootEscalated() bool {
return er.NewRunUserAsRoot.IsEscalated()
}

// runAsUser (root -> non root)
func (er *EscalationReport) RunUserAsRootReduced() bool {
return er.RemovedRunUserAsRoot.IsReduced()
}

// runAsUser
func (er *EscalationReport) RunUserAsRootNoChange() bool {
return !er.RunUserAsRootEscalated() && !er.RunUserAsRootReduced()
}

// runAsGroup (non root -> root)
func (er *EscalationReport) RunGroupAsRootEscalated() bool {
return er.NewRunGroupAsRoot.IsEscalated()
}

// runAsGroup (root -> non root)
func (er *EscalationReport) RunGroupAsRootReduced() bool {
return er.RemovedRunGroupAsRoot.IsReduced()
}

// runAsGroup
func (er *EscalationReport) RunGroupAsRootNoChange() bool {
return er.NewRunGroupAsRoot.NoChanges()
}

// newly added volume types
func (er *EscalationReport) AddedVolumes() bool {
return len(er.NewVolumeTypes) > 0
}

// removed volume types
func (er *EscalationReport) RemovedVolumes() bool {
return len(er.RemovedVolumeTypes) > 0
}

// added capabilities
func (er *EscalationReport) AddedCapabilities() bool {
return len(er.NewCapabilities) > 0
}

// dropped capabilities
func (er *EscalationReport) DroppedCapabilities() bool {
return len(er.RemovedCapabilities) > 0
}

func (er *EscalationReport) Escalated() bool {
if er.PrivilegeEscalated() || er.HostNetworkEscalated() || er.HostPIDEscalated() || er.HostIPCEscalated() || er.AddedVolumes() ||
if er.PrivilegedEscalated() || er.HostNetworkEscalated() || er.HostPIDEscalated() || er.HostIPCEscalated() || er.AddedVolumes() ||
er.AddedCapabilities() || er.ReadOnlyRootFSEscalated() || er.RunGroupAsRootEscalated() || er.RunUserAsRootEscalated() {
return true
}
Expand All @@ -249,88 +294,25 @@ func (er *EscalationReport) Escalated() bool {
}

func (er *EscalationReport) Reduced() bool {
if er.PrivilegeReduced() || er.HostNetworkReduced() || er.HostPIDReduced() || er.HostIPCReduced() || er.RemovedVolumes() ||
if er.PrivilegedReduced() || er.HostNetworkReduced() || er.HostPIDReduced() || er.HostIPCReduced() || er.RemovedVolumes() ||
er.DroppedCapabilities() || er.ReadOnlyRootFSReduced() || er.RunGroupAsRootReduced() || er.RunUserAsRootReduced() {
return true
}

return false
}

func (er *EscalationReport) NoChanges() bool {
if !er.NewPrivileged.NoChanges() {
return false
}

if !er.NewHostIPC.NoChanges() {
return false
}

if !er.NewHostPID.NoChanges() {
return false
}

if !er.NewHostNetwork.NoChanges() {
return false
}

if !er.NewRunGroupAsRoot.NoChanges() {
return false
}

if !er.NewRunUserAsRoot.NoChanges() {
return false
}

if !er.NewReadOnlyRootFS.NoChanges() {
return false
}

if len(er.RemovedCapabilities) > 0 {
return false
}

if len(er.NewCapabilities) > 0 {
return false
}

if len(er.RemovedVolumeTypes) > 0 {
return false
}

if len(er.NewVolumeTypes) > 0 {
return false
}

return true
}

// GenerateEscalationReportFromSecurityContext returns a escalation report after comparing the source and target YAML files
func (er *EscalationReport) GenerateEscalationReportFromSecurityContext(srcCssList, targetCssList []ContainerSecuritySpec, srcPssList, targetPssList []PodSecuritySpec) {
srcCssMap := map[Metadata]ContainerSecuritySpec{}
targetCssMap := map[Metadata]ContainerSecuritySpec{}
srcCssMap := NewContainerSecuritySpecMap(srcCssList)
targetCssMap := NewContainerSecuritySpecMap(targetCssList)

srcPssMap := map[Metadata]PodSecuritySpec{}
targetPssMap := map[Metadata]PodSecuritySpec{}
srcPssMap := NewPodSecuritySpecMap(srcPssList)
targetPssMap := NewPodSecuritySpecMap(targetPssList)

escalations := InitEscalation(Escalated, "", "")
reductions := InitEscalation(Reduced, "", "")

for _, css := range srcCssList {
srcCssMap[css.Metadata] = css
}

for _, css := range targetCssList {
targetCssMap[css.Metadata] = css
}

for _, pss := range srcPssList {
srcPssMap[pss.Metadata] = pss
}

for _, pss := range targetPssList {
targetPssMap[pss.Metadata] = pss
}

// privileged - false to true (escalated)
for meta, targetCss := range targetCssMap {
srcCss, exits := srcCssMap[meta]
Expand Down Expand Up @@ -545,8 +527,8 @@ func (er *EscalationReport) GenerateEscalationReportFromSecurityContext(srcCssLi
e.ConsolidateWorkload()
}

escalations.ConsolidateWorkload()
reductions.ConsolidateWorkload()
escalations.ConsolidateWorkloadImage()
reductions.ConsolidateWorkloadImage()

er.Escalations = append(er.Escalations, escalations.Workloads...)
er.Reductions = append(er.Reductions, reductions.Workloads...)
Expand All @@ -555,6 +537,8 @@ func (er *EscalationReport) GenerateEscalationReportFromSecurityContext(srcCssLi
er.TotalReduction = len(er.Reductions)
er.TotalSourceWorkloads = len(srcPssMap)
er.TotalTargetWorkloads = len(targetPssMap)
er.TotalSourceImages = len(srcCssMap)
er.TotalTargetImages = len(targetCssMap)
}

func getEscalatedStatus(status int) string {
Expand Down
9 changes: 0 additions & 9 deletions advisor/types/escalation_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,6 @@ import (
"bytes"
"encoding/json"
"fmt"
"testing"

"k8s.io/api/policy/v1beta1"

Expand Down Expand Up @@ -58,14 +57,6 @@ spec:
`
)

func TestNoChanges(t *testing.T) {
r := NewEscalationReport()

if !r.NoChanges() {
t.Fatal("new report should not contain an changes.")
}
}

func readPSPYaml(pspInput string) (*v1beta1.PodSecurityPolicy, error) {
var psp v1beta1.PodSecurityPolicy

Expand Down
29 changes: 22 additions & 7 deletions advisor/types/securityspec.go
View file
Original file line number Diff line number Diff line change
@@ -1,7 +1,5 @@
package types

import "github.com/sysdiglabs/kube-psp-advisor/utils"

var (
DefaultCaps = []string{
"SETPCAP",
Expand Down Expand Up @@ -77,13 +75,30 @@ type Metadata struct {
Name string `json:"name"`
Kind string `json:"kind"`
Namespace string `json:"namespace"`
YamlFile string `json:"file"`
YamlFile string `json:"file,omitempty"`
Image string `json:"image,omitempty"`
}

type PodSecuritySpecMap map[Metadata]PodSecuritySpec

func NewPodSecuritySpecMap(pssList []PodSecuritySpec) PodSecuritySpecMap {
pssMap := PodSecuritySpecMap{}

for _, pss := range pssList {
pssMap[pss.Metadata] = pss
}

return pssMap
}

func (css ContainerSecuritySpec) ContainCapability(cap string) bool {
m := utils.ArrayToMap(css.Capabilities)
type ContainerSecuritySpecMap map[Metadata]ContainerSecuritySpec

_, exsits := m[cap]
func NewContainerSecuritySpecMap(cssList []ContainerSecuritySpec) ContainerSecuritySpecMap {
cssMap := ContainerSecuritySpecMap{}
for _, css := range cssList {
css.Metadata.Image = css.ImageName
cssMap[css.Metadata] = css
}

return exsits
return cssMap
}
Loading

0 comments on commit a17acbc

Please sign in to comment.