containers / udica

This repository contains a tool for generating SELinux security profiles for containers
GNU General Public License v3.0
488 stars 47 forks source link

Lack of check that check presence of sections #105

Closed WellIDKRealy closed 2 years ago

WellIDKRealy commented 3 years ago

Describe the bug If some sections are not present for example Mounts udcia will crash with Key error as cause etc

Even if i did something completely wrong it should be indicated Key Error error does not indicate it well IMO

To Reproduce Make any container that does not have Mounts. NetworkSettings or Host config run idcia on it Example steps podman pod create --name a podman run -it --rm --pod a fedora /bin/bash podman inspect k8s.gcr.io/pause:3.5

Expected behavior Policy for mounts shoudl't be added if mounts are not present etc

Proposed Fix https://github.com/WellIDKRealy/udica

i didn't test it extensively so i have no idea if i broke something

vmojzis commented 2 years ago

Thanks for the suggestion. I'll definitely add some sort of checking. Your approach is interesting and I actually learned a lot trying to understand it.

I'm just wondering if there was any reason to use decorator factory instead of a simple decorator that would catch KeyError. e.g.

def getter_decorator(function):
    def wrapper(self, data, *args):
        try:
            value = function(self, data, *args)
            return value if value else []
        except KeyError,TypeError:
            return []

    return wrapper

Also, returning [] instead of None saves us from editing more code (since all the values are later processed as iterables).

WellIDKRealy commented 2 years ago

I used decorator factory because if there was any error unrelated to sections not existing and of the same type as error caused by nonexistence of them it still would be caught.

Anyways thanks for adding those checks.