--- # ========================== MACROS ========================== # # Macros can specify shared / common attributes referenced by one or more risk rules below. # If you choose to use specific macro for a given risk rule please specifying `macro: ` in rule definition. # Note: Attributes defined in macro will take precedence i.e. replace the same attributes defined on the rule level. # # Macro can contain any of the following attributes: # # :query - RedisGraph query (see README.md). Has precedence over :template. Requires :writer to be defined. # :writer - Writer is a (Ruby) expression used to format :query result set. Writer has precedence over :template. # :template - Built-in query/writer template name. If :query & :writer are not specified then chosen # query generator will be used along with matching writer. See rule attributes below for more information. # macros: # risky-role: # query: # Shared GraphQL query # writer: # Shared Writer expression (Ruby) # template: # Shared built-in query/writer template # ========================== RULES ========================== # # Rule can contain any of the following attributes: # :id - [Required] Rule id should be a unique # :group_title - [Required] Title applying to all items falling under this risk check # :severity - [Required] Severity, as one of :danger, :warning, :info # :info - [Required] Textual information about the check and suggestions on how to mitigate the risk # :query - [Conditonal] RedisGraph query (see README.md). Has precedence over :template. Requires :writer to be defined. # :writer - [Conditonal] Writer is a Ruby expression used to format query result set. Writer has precedence over :template. Required :query to be defined. # :template - [Conditonal] Built-in query/writer template name. If :query & :writer are not specified then chosen # query generator will be used along with matching writer. # Some templates require `:match_rules` attribute to be specified on individual rule level in order to build correct query. # Supported templates kinds: # - risky-role : Builds multi-match graph query based on the access rule specified in :match_rules. # Attributes and values in :match_rule follow Kubernetes spec at: # * https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-examples # Generated graph query returns the following columns: # * role_name # * role_kind # * namespace_name (an array is returned if multiple items returned) # :match_rules - [Conditonal] Required when :template relies on match rules in order to build a query. # Example: # match_rules: # - resources: ['cronjobs'] # verbs: ['update'] # :custom_params - List of custom key-value pairs to be replaced in resolved :query / :writer. # Example: # custom_params: # - attrA: valueA # - attrB: valueB # Templated placeholders for keys above `` and `` will be replaced with `valueA` and `valueB` respectively. # :threshold - [Optional] Numeric value. When definied this will become available as templated placeholder `` in writer expression. # :macro - [Optional] Reference to common parameters set defined in a named macro # :disabled - [Optional] When set to `true` it'll disable given rule and exclude it from evaluation. # By default all rules are enabled. # rules: # # ==== Begin Example Rule ==== # - id: example-rule group_title: Example rule severity: :danger info: Risk description and instructions on how to mitigate it goes here query: | # Example query: match all subjects and associated namespaces to which subject has access to MATCH (s:Subject)-[:ACCESS]->(ns:Namespace) RETURN s.kind as subject_kind, s.name as subject_name, COLLECT(ns.name) as namespace_names ORDER BY subject_kind, subject_name, namespace_names DESC threshold: 2 # threshold used in writer to limit items to those with at least 2 namespaces writer: | # Ruby code snippet, last expression will be captured as formatted result item output if result.namespace_names.count >= "#{result.subject_kind} #{result.subject_name} can access namespaces: #{result.namespace_names.join(', ')}" end disabled: true # This is just an example rule # # ==== End Example Rule ==== # - id: subjects-with-privileged-psp-not-scoped-to-ns group_title: Subjects with privileged PSP access NOT scoped to a namespace severity: :danger info: | Subjects below are able to run privileged containers and are NOT scoped to a particular namespace. Review PSP policies and limit subject's access to specific namespaces. template: privileged-psp-subjects - id: subjects-with-open-cluster-wide-access group_title: Subjects with too open cluster-wide access severity: :danger info: | Subjects below have URESTRICTED cluster-wide access to ALL resources (apiGroups: *, core)! This is potentially dangerous. Review RBAC associated with items below and limit access to required namespaces only. template: unrestricted-cluster-wide-subjects - id: subjects-with-open-ns-level-access group_title: Subjects with too open namespace level access severity: :warning info: | Subjects below have UNRESTRICTED access to ALL resources (apiGroups: *, core) within the scope of a namespace. This might be a potential security risk. Review RBAC associated with items below and replace wildcard access with more specific access rules. template: unrestricted-ns-level-subjects - id: subjects-with-rbac-management group_title: Subjects with ability to manage RBAC severity: :warning info: | List of Subjects able to create Roles and/or RoleBindings. This might be a potential security risk. Review RBAC associated with items below and consider revoking unnecessary privileges. template: rbac-managing-subjects - id: subjects-with-non-existing-roles group_title: Subjects associated with non-existing roles severity: :warning info: | List of Subjects with Role or ClusterRole which hasn't been defined. Review and check whether Role/ClusterRole should exist. template: undefined-role-subjects - id: subjects-with-many-roles group_title: Subjects associated with multiple roles severity: :info info: | List of Subjects associated with multiple roles. Depending on complexity this may indicate a bad RBAC design. Consider role aggregation. template: multiple-role-subjects threshold: 4 - id: namespaces-with-many-subjects group_title: Namespaces with multiple subjects severity: :info info: | List of Namespaces with multiple subject access. Significant number of Subjects having access to a Namespace might indicate bad design or potential security risk. Review namespaces below. template: multiple-subject-namespaces threshold: 5 # Secrets list / get - id: risky-get-secrets group_title: Risky Roles/ClusterRoles allowing viewing specific secrets severity: :warning info: Roles/ClusterRoles allowing to view specific secrets. This can be dangerous. Review listed Roles! template: risky-role match_rules: - resources: ['secrets'] verbs: ['get'] - id: risky-list-secrets group_title: Risky Roles/ClusterRoles allowing listing of all secrets severity: :warning info: Roles/ClusterRoles allowing to list all secrets. This can be dangerous. Review listed Roles! template: risky-role match_rules: - resources: ['secrets'] verbs: ['list'] # Impersonation - id: risky-impersonate-privileged-groups group_title: Risky Roles/ClusterRoles allowing to impersonate privileged groups (like 'system:masters') severity: :danger info: Roles/ClusterRoles allowing to impersonate privileged groups. This is dangerous. Review listed Roles! template: risky-role match_rules: - resources: ['groups'] verbs: ['impersonate'] # All actions (*) on specific resource - id: risky-any-verb-secrets group_title: Risky Roles/ClusterRoles allowing all actions on secrets severity: :danger info: Roles/ClusterRoles allowing all actions on secrets. This might be dangerous. Review listed Roles! template: risky-role match_rules: - resources: ['secrets'] verbs: ['*'] - id: risky-any-verb-pods group_title: Risky Roles/ClusterRoles allowing all actions on pods severity: :danger info: Roles/ClusterRoles allowing all actions on pods. This might be dangerous. Review listed Roles! template: risky-role match_rules: - resources: ['pods'] verbs: ['*'] - id: risky-any-verb-deployments group_title: Risky Roles/ClusterRoles allowing all actions on deployments severity: :danger info: Roles/ClusterRoles allowing all actions on deployments. This might be dangerous. Review listed Roles! template: risky-role match_rules: - resources: ['deployments'] verbs: ['*'] - id: risky-any-verb-daemonsets group_title: Risky Roles/ClusterRoles allowing all actions on daemonsets severity: :danger info: Roles/ClusterRoles allowing all actions on daemonsets. This might be dangerous. Review listed Roles! template: risky-role match_rules: - resources: ['daemonsets'] verbs: ['*'] - id: risky-any-verb-statefulsets group_title: Risky Roles/ClusterRoles allowing all actions on statefulsets severity: :danger info: Roles/ClusterRoles allowing all actions on statefulsets. This might be dangerous. Review listed Roles! template: risky-role match_rules: - resources: ['statefulsets'] verbs: ['*'] - id: risky-any-verb-replicationcontrollers group_title: Risky Roles/ClusterRoles allowing all actions on replicationcontrollers severity: :danger info: Roles/ClusterRoles allowing all actions on replicationcontrollers. This might be dangerous. Review listed Roles! template: risky-role match_rules: - resources: ['replicationcontrollers'] verbs: ['*'] - id: risky-any-verb-replicasets group_title: Risky Roles/ClusterRoles allowing all actions on replicasets severity: :danger info: Roles/ClusterRoles allowing all actions on replicasets. This might be dangerous. Review listed Roles! template: risky-role match_rules: - resources: ['replicasets'] verbs: ['*'] - id: risky-any-verb-cronjobs group_title: Risky Roles/ClusterRoles allowing all actions on cronjobs severity: :danger info: Roles/ClusterRoles allowing all actions on cronjobs. This might be dangerous. Review listed Roles! template: risky-role match_rules: - resources: ['cronjobs'] verbs: ['*'] - id: risky-any-verb-jobs group_title: Risky Roles/ClusterRoles allowing all actions on jobs severity: :danger info: Roles/ClusterRoles allowing all actions on jobs. This might be dangerous. Review listed Roles! template: risky-role match_rules: - resources: ['jobs'] verbs: ['*'] - id: risky-any-verb-roles group_title: Risky Roles/ClusterRoles allowing all actions on roles severity: :danger info: Roles/ClusterRoles allowing all actions on roles. This might be dangerous. Review listed Roles! template: risky-role match_rules: - resources: ['roles'] verbs: ['*'] - id: risky-any-verb-clusterroles group_title: Risky Roles/ClusterRoles allowing all actions on clusterroles severity: :danger info: Roles/ClusterRoles allowing all actions on clusterroles. This might be dangerous. Review listed Roles! template: risky-role match_rules: - resources: ['clusterroles'] verbs: ['*'] - id: risky-any-verb-rolebindings group_title: Risky Roles/ClusterRoles allowing all actions on rolebindings severity: :danger info: Roles/ClusterRoles allowing all actions on rolebindings. This might be dangerous. Review listed Roles! template: risky-role match_rules: - resources: ['rolebindings'] verbs: ['*'] - id: risky-any-verb-clusterrolebindings group_title: Risky Roles/ClusterRoles allowing all actions on clusterrolebindings severity: :danger info: Roles/ClusterRoles allowing all actions on clusterrolebindings. This might be dangerous. Review listed Roles! template: risky-role match_rules: - resources: ['clusterrolebindings'] verbs: ['*'] - id: risky-any-verb-users group_title: Risky Roles/ClusterRoles allowing all actions on users severity: :danger info: "Roles/ClusterRoles allowing all actions on users. This might be dangerous. Review listed Roles!" template: risky-role match_rules: - resources: ['users'] verbs: ['*'] - id: risky-any-verb-groups group_title: Risky Roles/ClusterRoles allowing all actions on groups severity: :danger info: Roles/ClusterRoles allowing all actions on groups. This might be dangerous. Review listed Roles! template: risky-role match_rules: - resources: ['groups'] verbs: ['*'] # Specific action on all (*) resources - id: risky-any-resource-delete group_title: Risky Roles/ClusterRoles allowing delete action on all resources severity: :danger info: Roles/ClusterRoles allowing delete action on all resources. This might be dangerous. Review listed Roles! template: risky-role match_rules: - resources: ['*'] verbs: ['delete'] - id: risky-any-resource-deletecollection group_title: Risky Roles/ClusterRoles allowing deletecollection action on all resources severity: :danger info: Roles/ClusterRoles allowing deletecollection action on all resources. This might be dangerous. Review listed Roles! template: risky-role match_rules: - resources: ['*'] verbs: ['deletecollection'] - id: risky-any-resource-create group_title: Risky Roles/ClusterRoles allowing create action on all resources severity: :danger info: Roles/ClusterRoles allowing create action on all resources. This might be dangerous. Review listed Roles! template: risky-role match_rules: - resources: ['*'] verbs: ['create'] - id: risky-any-resource-list group_title: Risky Roles/ClusterRoles allowing list action on all resources severity: :danger info: Roles/ClusterRoles allowing list action on all resources. This might be dangerous. Review listed Roles! template: risky-role match_rules: - resources: ['*'] verbs: ['list'] - id: risky-any-resource-get group_title: Risky Roles/ClusterRoles allowing get action on all resources severity: :danger info: Roles/ClusterRoles allowing get action on all resources. This might be dangerous. Review listed Roles! template: risky-role match_rules: - resources: ['*'] verbs: ['get'] - id: risky-any-resource-impersonate group_title: Risky Roles/ClusterRoles allowing impersonate action on all resources severity: :danger info: Roles/ClusterRoles allowing impersonate action on all resources. This might be dangerous. Review listed Roles! template: risky-role match_rules: - resources: ['*'] verbs: ['impersonate'] # Malicious pod - id: risky-create-deployments group_title: Risky Roles/ClusterRoles allowing to create a potentially malicious pod severity: :warning info: Roles/ClusterRoles allowing to create a potentially malicious pod. This might be dangerous. Review listed Roles! template: risky-role match_rules: - resources: ['deployments'] verbs: ['create'] - id: risky-update-deployments group_title: Risky Roles/ClusterRoles allowing to update a potentially malicious pod severity: :warning info: Roles/ClusterRoles allowing to update a potentially malicious pod. This might be dangerous. Review listed Roles! template: risky-role match_rules: - resources: ['deployments'] verbs: ['update'] - id: risky-create-daemonsets group_title: Risky Roles/ClusterRoles allowing to create a potentially malicious daemonset severity: :warning info: Roles/ClusterRoles allowing to create a potentially malicious daemonset. This might be dangerous. Review listed Roles! template: risky-role match_rules: - resources: ['daemonsets'] verbs: ['create'] - id: risky-update-daemonsets group_title: Risky Roles/ClusterRoles allowing to update a potentially malicious daemonset severity: :warning info: Roles/ClusterRoles allowing to update a potentially malicious daemonset. This might be dangerous. Review listed Roles! template: risky-role match_rules: - resources: ['daemonsets'] verbs: ['update'] - id: risky-create-statefulsets group_title: Risky Roles/ClusterRoles allowing to create a potentially malicious statefulset severity: :warning info: Roles/ClusterRoles allowing to create a potentially malicious statefulset. This might be dangerous. Review listed Roles! template: risky-role match_rules: - resources: ['statefulsets'] verbs: ['create'] - id: risky-update-statefulsets group_title: Risky Roles/ClusterRoles allowing to update a potentially malicious statefulset severity: :warning info: Roles/ClusterRoles allowing to update a potentially malicious statefulset. This might be dangerous. Review listed Roles! template: risky-role match_rules: - resources: ['statefulsets'] verbs: ['update'] - id: risky-create-replicationcontrollers group_title: Risky Roles/ClusterRoles allowing to create a potentially malicious replicationcontroller severity: :warning info: Roles/ClusterRoles allowing to create a potentially malicious replicationcontroller. This might be dangerous. Review listed Roles! template: risky-role match_rules: - resources: ['replicationcontrollers'] verbs: ['create'] - id: risky-update-replicationcontrollers group_title: Risky Roles/ClusterRoles allowing to update a potentially malicious replicationcontroller severity: :warning info: Roles/ClusterRoles allowing to update a potentially malicious replicationcontroller. This might be dangerous. Review listed Roles! template: risky-role match_rules: - resources: ['replicationcontrollers'] verbs: ['update'] - id: risky-create-replicasets group_title: Risky Roles/ClusterRoles allowing to create a potentially malicious replicaset severity: :warning info: Roles/ClusterRoles allowing to create a potentially malicious replicaset. This might be dangerous. Review listed Roles! template: risky-role match_rules: - resources: ['replicasets'] verbs: ['create'] - id: risky-update-replicasets group_title: Risky Roles/ClusterRoles allowing to update a potentially malicious replicaset severity: :warning info: Roles/ClusterRoles allowing to update a potentially malicious replicaset. This might be dangerous. Review listed Roles! template: risky-role match_rules: - resources: ['replicasets'] verbs: ['update'] - id: risky-create-jobs group_title: Risky Roles/ClusterRoles allowing to create a potentially malicious job severity: :warning info: Roles/ClusterRoles allowing to create a potentially malicious job. This might be dangerous. Review listed Roles! template: risky-role match_rules: - resources: ['jobs'] verbs: ['create'] - id: risky-update-jobs group_title: Risky Roles/ClusterRoles allowing to update a potentially malicious job severity: :warning info: Roles/ClusterRoles allowing to update a potentially malicious job. This might be dangerous. Review listed Roles! template: risky-role match_rules: - resources: ['jobs'] verbs: ['update'] - id: risky-create-cronjobs group_title: Risky Roles/ClusterRoles allowing to create a potentially malicious cronjob severity: :warning info: Roles/ClusterRoles allowing to create a potentially malicious cronjob. This might be dangerous. Review listed Roles! template: risky-role match_rules: - resources: ['cronjobs'] verbs: ['create'] - id: risky-update-cronjobs group_title: Risky Roles/ClusterRoles allowing to update a potentially malicious cronjob severity: :warning info: Roles/ClusterRoles allowing to update a potentially malicious cronjob. This might be dangerous. Review listed Roles! template: risky-role match_rules: - resources: ['cronjobs'] verbs: ['update'] # Multiple permissions simulaneously - id: risky-create-rolebinding-role group_title: Risky Roles/ClusterRoles allowing creation of rolebinding and associate privileged role to itself severity: :warning info: Roles able to create bindings referencing roles. This might be dangerous. Review listed Roles! template: risky-role match_rules: - apiGroups: ['rbac.authorization.k8s.io'] resources: ['rolebindings'] verbs: ['create'] - apiGroups: ['rbac.authorization.k8s.io'] resources: ['roles'] verbs: ['bind'] - id: risky-create-rolebinding-clusterrole group_title: Risky Roles/ClusterRoles allowing creation of rolebinding and associate privileged clusterrole to itself severity: :warning info: Roles able to create bindings referencing cluster roles. This might be dangerous. Review listed Roles! template: risky-role match_rules: - apiGroups: ['rbac.authorization.k8s.io'] resources: ['rolebindings'] verbs: ['create'] - apiGroups: ['rbac.authorization.k8s.io'] resources: ['clusterroles'] verbs: ['bind'] - id: risky-create-clusterrolebinding group_title: Risky Roles/ClusterRoles allowing creation of clusterrolebinding severity: :warning info: Roles able to create cluster role bindings. This might be dangerous. Review listed Roles! template: risky-role match_rules: - apiGroups: ['rbac.authorization.k8s.io'] resources: ['clusterrolebindings'] verbs: ['create'] # Pod exec / attach - id: risky-exec-pods group_title: Risky Roles/ClusterRoles allowing shell on pods severity: :danger info: Roles allow exec into running container. This might be dangerous. Review listed Roles! template: risky-role match_rules: - resources: ['pods/exec'] verbs: ['create'] - resources: ['pods'] verbs: ['get'] - id: risky-attach-pods group_title: Risky Roles/ClusterRoles allowing attaching pod and view all its logs in realtime severity: :danger info: Roles allow attaching to a running container. This might be dangerous. Review listed Roles! template: risky-role match_rules: - resources: ['pods/attach'] verbs: ['create'] - resources: ['pods'] verbs: ['get'] # Low priority - id: risky-add-rolebinding group_title: Risky Roles/ClusterRoles allowing users in a rolebinding to add other users to their rolebindings severity: :warning info: This might be dangerous. Review listed Roles! template: risky-role match_rules: - resources: ['rolebindings'] verbs: ['patch', 'get']