Skip to content

Commit 8c3fdfa

Browse files
sheriff-rhsheriff-rh
committed
Adding the Security Profiles Operator to OpenShift
1 parent 73f01fd commit 8c3fdfa

37 files changed

+1725
-1
lines changed

‎_topic_maps/_topic_map.yml

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -899,6 +899,27 @@ Topics:
899899
File: file-integrity-operator-advanced-usage
900900
- Name: Troubleshooting the File Integrity Operator
901901
File: file-integrity-operator-troubleshooting
902+
- Name: Security Profiles Operator
903+
Dir: security_profiles_operator
904+
Topics:
905+
- Name: Security Profiles Operator overview
906+
File: spo-overview
907+
- Name: Security Profiles Operator release notes
908+
File: spo-release-notes
909+
- Name: Understanding the Security Profiles Operator
910+
File: spo-understanding
911+
- Name: Enabling the Security Profiles Operator
912+
File: spo-enabling
913+
- Name: Managing seccomp profiles
914+
File: spo-seccomp
915+
- Name: Managing SELinux profiles
916+
File: spo-selinux
917+
- Name: Advanced Security Profiles Operator tasks
918+
File: spo-advanced
919+
- Name: Troubleshooting the Security Profiles Operator
920+
File: spo-troubleshooting
921+
- Name: Uninstalling the Security Profiles Operator
922+
File: spo-uninstalling
902923
- Name: cert-manager Operator for Red Hat OpenShift
903924
Dir: cert_manager_operator
904925
Distros: openshift-enterprise

‎modules/spo-about.adoc

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/security_profiles_operator/spo-understanding.adoc
4+
5+
:_content-type: CONCEPT
6+
[id="spo-about_{context}"]
7+
= About Security Profiles
8+
9+
Security profiles can increase security at the container level in your cluster.
10+
11+
Seccomp security profiles list the syscalls a process can make. Permissions are broader than SELinux, enabling users to restrict operations system-wide, such as `write`.
12+
13+
SELinux security profiles provide a label-based system that restricts the access and usage of processes, applications, or files in a system. All files in an environment have labels that define permissions. SELinux profiles can define access within a given structure, such as directories.

‎modules/spo-applying-profiles.adoc

Lines changed: 184 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,184 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/security_profiles_operator/spo-seccomp.adoc
4+
// * security/security_profiles_operator/spo-selinux.adoc
5+
6+
ifeval::["{context}" == "spo-seccomp"]
7+
:seccomp:
8+
:type: seccomp
9+
:kind: SeccompProfile
10+
endif::[]
11+
ifeval::["{context}" == "spo-selinux"]
12+
:selinux:
13+
:type: SELinux
14+
:kind: SelinuxProfile
15+
endif::[]
16+
17+
:_content-type: PROCEDURE
18+
[id="spo-applying-profiles_{context}"]
19+
= Applying {type} profiles to a pod
20+
21+
Create a pod to apply one of the created profiles.
22+
23+
ifdef::selinux[]
24+
For {type} profiles, the namespace must be labelled to allow link:https://kubernetes.io/docs/concepts/security/pod-security-standards/[privileged] workloads.
25+
26+
endif::[]
27+
.Procedure
28+
29+
ifdef::seccomp[]
30+
. Create a pod object that defines a `securityContext`:
31+
+
32+
[source,yaml]
33+
----
34+
apiVersion: v1
35+
kind: Pod
36+
metadata:
37+
name: test-pod
38+
spec:
39+
securityContext:
40+
seccompProfile:
41+
type: Localhost
42+
localhostProfile: operator/my-namespace/profile1.json
43+
containers:
44+
- name: test-container
45+
image: quay.io/security-profiles-operator/test-nginx-unprivileged:1.21
46+
----
47+
48+
. View the profile path of the `seccompProfile.localhostProfile` attribute by running the following command:
49+
+
50+
[source,terminal]
51+
----
52+
$ oc -n my-namespace get seccompprofile profile1 --output wide
53+
----
54+
+
55+
.Example output
56+
[source,terminal]
57+
----
58+
NAME STATUS AGE SECCOMPPROFILE.LOCALHOSTPROFILE
59+
profile1 Active 14s operator/my-namespace/profile1.json
60+
----
61+
62+
. View the path to the localhost profile by running the following command:
63+
+
64+
[source,terminal]
65+
----
66+
$ oc get sp profile1 --output=jsonpath='{.status.localhostProfile}'
67+
----
68+
+
69+
.Example output
70+
[source,terminal]
71+
----
72+
operator/my-namespace/profile1.json
73+
----
74+
75+
. Apply the `localhostProfile` output to the patch file:
76+
+
77+
[source,yaml]
78+
----
79+
spec:
80+
template:
81+
spec:
82+
securityContext:
83+
seccompProfile:
84+
type: Localhost
85+
localhostProfile: operator/my-namespace/profile1.json
86+
----
87+
88+
. Apply the profile to a `Deployment` object by running the following command:
89+
+
90+
[source,terminal]
91+
----
92+
$ oc -n my-namespace patch deployment myapp --patch-file patch.yaml --type=merge
93+
----
94+
+
95+
.Example output
96+
[source,terminal]
97+
----
98+
deployment.apps/myapp patched
99+
----
100+
101+
.Verification
102+
103+
* Confirm the profile was applied correctly by running the following command:
104+
+
105+
[source,terminal]
106+
----
107+
$ oc -n my-namespace get deployment myapp --output=jsonpath='{.spec.template.spec.securityContext}' | jq .
108+
----
109+
+
110+
.Example output
111+
[source,json]
112+
----
113+
{
114+
"seccompProfile": {
115+
"localhostProfile": "operator/my-namespace/profile1.json",
116+
"type": "localhost"
117+
}
118+
}
119+
----
120+
endif::[]
121+
ifdef::selinux[]
122+
123+
. Apply the `scc.podSecurityLabelSync=false` label to the `nginx-deploy` namespace by running the following command:
124+
+
125+
[source,terminal]
126+
----
127+
$ oc label ns nginx-deploy security.openshift.io/scc.podSecurityLabelSync=false
128+
----
129+
130+
. Apply the `privileged` label to the `nginx-deploy` namespace by running the following command:
131+
+
132+
[source,terminal]
133+
----
134+
$ oc label ns nginx-deploy --overwrite=true pod-security.kubernetes.io/enforce=privileged
135+
----
136+
137+
. Obtain the SELinux profile usage string by running the following command:
138+
+
139+
[source,terminal]
140+
----
141+
$ oc get selinuxprofile.security-profiles-operator.x-k8s.io/nginx-secure -n nginx-deploy -ojsonpath='{.status.usage}'
142+
----
143+
+
144+
.Example output
145+
[source,terminal]
146+
----
147+
nginx-secure_nginx-deploy.process%
148+
----
149+
150+
. Apply the output string in the workload manifest in the `.spec.containers[].securityContext.seLinuxOptions` attribute:
151+
+
152+
[source,yaml]
153+
----
154+
apiVersion: v1
155+
kind: Pod
156+
metadata:
157+
name: nginx-secure
158+
namespace: nginx-deploy
159+
spec:
160+
containers:
161+
- image: nginxinc/nginx-unprivileged:1.21
162+
name: nginx
163+
securityContext:
164+
seLinuxOptions:
165+
# NOTE: This uses an appropriate SELinux type
166+
type: nginx-secure_nginx-deploy.process
167+
----
168+
+
169+
[IMPORTANT]
170+
====
171+
The SELinux `type` must exist before creating the workload.
172+
====
173+
endif::[]
174+
175+
ifeval::["{context}" == "spo-seccomp"]
176+
:!seccomp:
177+
:!type:
178+
:!kind:
179+
endif::[]
180+
ifeval::["{context}" == "spo-selinux"]
181+
:!selinux:
182+
:!type:
183+
:!kind:
184+
endif::[]

‎modules/spo-base-syscalls.adoc

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/security_profiles_operator/spo-advanced.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="spo-base-syscalls_{context}"]
7+
= Base syscalls for a container runtime
8+
9+
You can use the `baseProfileName` attribute to establish the minimum required `syscalls` for a given runtime to start a container.
10+
11+
.Procedure
12+
13+
* Edit the `SeccompProfile` kind object and add `baseProfileName: runc-v1.0.0` to the `spec` field:
14+
+
15+
[source,yaml]
16+
----
17+
apiVersion: security-profiles-operator.x-k8s.io/v1beta1
18+
kind: SeccompProfile
19+
metadata:
20+
namespace: my-namespace
21+
name: example-name
22+
spec:
23+
defaultAction: SCMP_ACT_ERRNO
24+
baseProfileName: runc-v1.0.0
25+
syscalls:
26+
- action: SCMP_ACT_ALLOW
27+
names:
28+
- exit_group
29+
----

‎modules/spo-binding-workloads.adoc

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/security_profiles_operator/spo-seccomp.adoc
4+
// * security/security_profiles_operator/spo-selinux.adoc
5+
6+
ifeval::["{context}" == "spo-seccomp"]
7+
:seccomp:
8+
:type: seccomp
9+
:kind: SeccompProfile
10+
endif::[]
11+
ifeval::["{context}" == "spo-selinux"]
12+
:selinux:
13+
:type: SELinux
14+
:kind: SelinuxProfile
15+
endif::[]
16+
17+
:_content-type: PROCEDURE
18+
[id="spo-binding-workloads_{context}"]
19+
= Binding workloads to profiles with ProfileBindings
20+
21+
You can use the `ProfileBinding` resource to bind a security profile to the `SecurityContext` of a container.
22+
23+
.Procedure
24+
25+
. To bind a pod that uses a `quay.io/security-profiles-operator/test-nginx-unprivileged:1.21` image to the example `{kind}` profile, create a `ProfileBinding` object in the same namespace with the pod and the `{kind}` objects:
26+
+
27+
[source,yaml,subs="attributes+"]
28+
----
29+
apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
30+
kind: ProfileBinding
31+
metadata:
32+
namespace: my-namespace
33+
name: nginx-binding
34+
spec:
35+
profileRef:
36+
kind: {kind} <1>
37+
name: profile <2>
38+
image: quay.io/security-profiles-operator/test-nginx-unprivileged:1.21
39+
----
40+
<1> The `kind:` variable refers to the name of the profile.
41+
<2> The `name:` variable refers to the name of the profile.
42+
43+
. Label the namespace with `enable-binding=true` by running the following command:
44+
+
45+
[source,terminal]
46+
----
47+
$ oc label ns my-namespace spo.x-k8s.io/enable-binding=true
48+
----
49+
50+
. Delete and re-create the pod to use the `ProfileBinding` object:
51+
+
52+
[source,terminal,subs="attributes+"]
53+
----
54+
$ oc delete pods test-pod && oc create -f pod01.yaml
55+
----
56+
57+
.Verification
58+
59+
ifdef::seccomp[]
60+
* Confirm the pod inherits the `ProfileBinding` by running the following command:
61+
+
62+
[source,terminal]
63+
----
64+
$ oc get pod test-pod -o jsonpath='{.spec.containers[*].securityContext.seccompProfile}'
65+
----
66+
+
67+
.Example output
68+
[source,terminal]
69+
----
70+
{"localhostProfile":"operator/my-namespace/profile.json","type":"Localhost"}
71+
----
72+
endif::[]
73+
ifdef::selinux[]
74+
* Confirm the pod inherits the `ProfileBinding` by running the following command:
75+
+
76+
[source,terminal]
77+
----
78+
$ oc get pod test-pod -o jsonpath='{.spec.containers[*].securityContext.seLinuxOptions.type}'
79+
----
80+
+
81+
.Example output
82+
[source,terminal]
83+
----
84+
profile_nginx-binding.process
85+
----
86+
endif::[]
87+
88+
89+
ifeval::["{context}" == "spo-seccomp"]
90+
:!seccomp:
91+
:!type:
92+
:!kind:
93+
endif::[]
94+
ifeval::["{context}" == "spo-selinux"]
95+
:!selinux:
96+
:!type:
97+
:!kind:
98+
endif::[]

0 commit comments

Comments
 (0)