← Policy catalog
</> ValidatingAdmissionPolicy · Apache-2.0

Runs With an Unconfined AppArmor Profile

container-apparmor-profile

severityModerate resourceContainers productKubernetes bundles2

An Unconfined AppArmor profile strips the mandatory access controls over file, capability and mount operations in the container, widening what a compromised process can reach on the host.

Rejects unless

object.spec.containers.all(c,
  !has(c.securityContext) ||
  !has(c.securityContext.appArmorProfile) ||
  !has(c.securityContext.appArmorProfile.type) ||
  variables.allowedAppArmorTypes.exists(t, t == c.securityContext.appArmorProfile.type)
)

spec.containers[*].securityContext.appArmorProfile.type must be undefined, RuntimeDefault, or Localhost.

Variables

allowedAppArmorTypes

["RuntimeDefault","Localhost"]

Remediation

Replace Unconfined with RuntimeDefault, or with Localhost naming a profile loaded on the node. Field: spec.containers[*].securityContext.appArmorProfile.type.

Applies to

  • pods · v1 · CREATE, UPDATE

Manifest

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: container-apparmor-profile
  annotations:
    kubeapt.io/uuid: "f95bfa81-151f-47a8-b98b-098085ab75bf"
    security.kubeapt.io/displayName: "Runs With an Unconfined AppArmor Profile"
    security.kubeapt.io/description: "An Unconfined AppArmor profile strips the mandatory access controls over file, capability and mount operations in the container, widening what a compromised process can reach on the host."
    security.kubeapt.io/resource: "Containers"
    security.kubeapt.io/severity: "Moderate"
    security.kubeapt.io/remediation: "Replace Unconfined with RuntimeDefault, or with Localhost naming a profile loaded on the node. Field: spec.containers[*].securityContext.appArmorProfile.type."
    security.kubeapt.io/product: "Kubernetes"
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
    - apiGroups:
      - ''
      apiVersions:
      - v1
      operations:
      - CREATE
      - UPDATE
      resources:
      - pods
  variables:
  - name: allowedAppArmorTypes
    expression: |
      ["RuntimeDefault","Localhost"]
  validations:
  - expression: |
      object.spec.containers.all(c,
        !has(c.securityContext) ||
        !has(c.securityContext.appArmorProfile) ||
        !has(c.securityContext.appArmorProfile.type) ||
        variables.allowedAppArmorTypes.exists(t, t == c.securityContext.appArmorProfile.type)
      )
    message: |
      spec.containers[*].securityContext.appArmorProfile.type must be undefined, RuntimeDefault, or Localhost.

Save it as container-apparmor-profile.yaml — the commands below assume that name.

Validate with kubeapt

Check a workload against this one policy, before anything is installed on a cluster.

$ kubeapt validate -p ./container-apparmor-profile.yaml -r ./workload.yaml

Or without the file, from the published policy set — -r takes a directory too:

$ kubeapt policies download && kubeapt validate --policy-name container-apparmor-profile -r ./manifests

Or against every namespace in the cluster your kubeconfig points at:

$ kubeapt validate --policy-name container-apparmor-profile -A

Bundles

Source

View policy.yaml on GitHub →