search

defenseunicorns / uds-core

A FOSS secure runtime platform for mission-critical capabilities
https://uds.defenseunicorns.com
GNU Affero General Public License v3.0
52 stars 21 forks source link

Add policy restricting usage of Istio user/group #1016

Open mjnagel opened 4 days ago

mjnagel commented 4 days ago

Istio uses the user/group of 1337 as a special user/group meant for the sidecar only. Allowing access to run as this user/group can provide an pathway of attack/way to bypass the sidecar.

We should add a new policy to block usage of this user/group except by the istio proxy. This policy should also have an exemption for consistency, likely called something like RestrictIstioUser.