search

PaloAltoNetworks / rbac-police

Evaluate the RBAC permissions of Kubernetes identities through policies written in Rego
https://www.paloaltonetworks.com/resources/whitepapers/kubernetes-privilege-escalation-excessive-permissions-in-popular-platforms
MIT License
331 stars 35 forks source link

fix: correct the detection logic for bind_roles #22

Closed Danny-Wei closed 4 months ago

Danny-Wei commented 8 months ago

Description

Only by granting accounts the bind permission of roles or clusterroles, they potentially elevate their privileges. Refer to Restrictions on role binding creation or update

Therefore, it is necessary to check whether the rules in the role include the bind verb for clusterroles or roles resources.

Motivation and Context

Correct the detection logic for bind_roles.

Types of changes

Checklist