[Workload] Check the Host PID/IPC privileges by isolating containers from the host

[agentpoyo]

[Acceptance Criteria] (TBD)

Workload Security test: Host PID/IPC privileges

Short description of platform test:

• Containers should be as isolated as possible from the host machine. The hostPID and hostIPC fields in Kubernetes may excessively expose the host for potentially malicious actions.

Remediation Details

• Apply least privilege principle and disable the hostPID and hostIPC fields unless strictly needed.

Test Category

• Security

References

• Ref: #963
• https://hub.armo.cloud/docs/c-0038#host-pidipc-privileges

---

Implementation Tasks: TBD

Environment set up tasks:

• [ ]

Upstream tool set up tasks: (test suite + upstream tools)

• [ ] kubescape

CNF setup Tasks

• [ ] ./cnf-testsuite host_pid_ipc_privileges

Sample CNF tasks:

• [ ]

Code implementation tasks:

• [ ]

Documentation tasks:

• [ ] Update Test Categories md if needed
• [ ] Update Pseudo Code md if needed
• [ ] Update USAGE md if needed
  • [ ] Add Description Details in USAGE md
  • [ ] Add Remediation Details or URL links in USAGE md
• [ ] Update installation instructions if needed

QA tasks

Dev Review:

• [ ] walk through A/C
• [ ] do you get the expected result?
• [ ] if yes,
  • [ ] move to Needs Peer Review column
  • [ ] create Pull Request and follow check list
  • [ ] Assign 1 or more people for peer review
• [ ] if no, document what additional tasks will be needed

Peer review:

• [ ] walk through A/C
• [ ] do you get the expected result?
• [ ] if yes,
  • [ ] move to Reviewer Approved column
  • [ ] Approve pull request
• [ ] if no,
  • [ ] document what did not go as expected, including error messages and screenshots (if possible)
  • [ ] Add comment to pull request
  • [ ] request changes to pull request

[agentpoyo]

Acceptance Criteria

---

Documentation is updated:

• [x] USAGE.md documentation updated
  • [x] how to run
  • [x] Description, remediation and details
    • [ ] what the best practice is
    • [ ] why are we testing this
• [ ] CATEGORIES updated

Common steps

• [x] Find or create a K8s cluster to use
  • Talk with team for access to an existing cluster
  • Kind K8s clusters will work as well
• [x] Set the KUBECONFIG environment variable for accessing the target K8s cluster
• [ ] As a developer, Pull down latest version of CNF conformance test code from {FEATURE} branch
  • [ ] Check that {FEATURE} Branch passes all A/C
  • [ ] Check that {FEATURE} Branch passes tests in GitHub Actions
• [x] As a peer reviewer, check that PR passes in GitHub Actions
  • [x] if yes, merge PR to master
  • [ ] if no, make a comment and request that developer make changes to pass tests
• [x] As a peer reviewer, Pull down latest version of CNF conformance test code from main branch
• [x] Run shards install

Update Prerequisite checker

• [ ] NA

Added to overall points:

• [ ] I see the test in the embedded points.yml as valid test score

When I run host_pid_ipc_privileges I should see test PASS or FAILED results:

• [x] Run ./cnf-testsuite cnf_setup cnf-config=./sample-cnfs/sample_coredns/cnf-testsuite.yml
• [x] Run ./cnf-testsuite host_pid_ipc_privileges
• [x] I can see PASSED/FAILED result output.

Screenshots of output:

• [x] I can see a screenshots of output

[agentpoyo]