Open rootxrishabh opened 7 months ago
@rootxrishabh Can you check posture values in kubearmor configmap kubearmor-config
?
The configmap does show up the values as intended. However, kubearmor-config does set posture settings globally and should block all activity related to file, process, and network globally, right?
@rootxrishabh yes you're right, global posture should be set to block
for process, file and network. have you tested the enforcement with an allow based policy?
Ok so it looks like the posture settings are working well!
Policy applied:
`apiVersion: security.kubearmor.com/v1
kind: KubeArmorPolicy
metadata:
name: ksp-ubuntu-5-net-tcp-allow-curl
namespace: default
spec:
severity: 8
selector:
matchLabels:
app: nginx
network:
matchProtocols:
Result -
root@nginx-85b98978db-mpjxz:/# curl google.com curl: (6) Could not resolve host: google.com
So I guess karmor probe
needs to be tweaked when working with operator-based deployment.
One last question, Basically posture is only enforced around a policy right? For example, all posture set to block without a policy doesn't deny all processes, network and file activities. Right?
One last question, Basically posture is only enforced around a policy right? For example, all posture set to block without a policy doesn't deny all processes, network and file activities. Right?
yes default posture comes into picture with a allow based policy, ref: https://github.com/kubearmor/KubeArmor/blob/main/getting-started/default_posture.md
Thanks @rksharma95, will be opening an issue at kubearmor-client for the probe info.
Bug Report
General Information
Linux kubearmor-os-1 6.2.0-1019-gcp kubearmor/KubeArmor#21~22.04.1-Ubuntu SMP Thu Nov 16 18:18:34 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
To Reproduce
Set default posture settings to block.![image](https://github.com/kubearmor/KubeArmor/assets/73490663/ea039736-5779-4210-8eda-828550c77cb0)
Deploy Kubearmor using helm-based local deployment.![image](https://github.com/kubearmor/KubeArmor/assets/73490663/d1efab95-acf2-4974-815a-c507dd05f8ee)
Confirm posture settings using![image](https://github.com/kubearmor/KubeArmor/assets/73490663/1e334415-e83f-4526-9d49-970d2d9547f1)
karmor probe
.Expected behavior Karmor probe should confirm that Default Posture is set to block based for File, Capabilities, and Network but rather shows audit. CC @rksharma95