Merge pull request #46 from anurag-rajawat/fix-adapter

fix(adapter): Add KSP for DNSManipulation
5GSEC · Jan 31, 2024 · 285edc9 · 285edc9
2 parents cf301c0 + 2ebf627
commit 285edc9
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 0 deletions.
diff --git a/go.sum b/go.sum
@@ -13,6 +13,7 @@ github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
 github.com/emicklei/go-restful/v3 v3.11.2 h1:1onLa9DcsMYO9P+CXaL0dStDqQ2EHHXLiz+BtnqkLAU=
 github.com/emicklei/go-restful/v3 v3.11.2/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/evanphx/json-patch v5.7.0+incompatible h1:vgGkfT/9f8zE6tvSCe74nfpAVDQ2tG6yudJd8LBksgI=
+github.com/evanphx/json-patch v5.7.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
 github.com/evanphx/json-patch/v5 v5.9.0 h1:kcBlZQbplgElYIlo/n1hJbls2z/1awpXxpRi0/FOJfg=
 github.com/evanphx/json-patch/v5 v5.9.0/go.mod h1:VNkHZ/282BpEyt/tObQO8s5CMPmYYq14uClGH4abBuQ=
 github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=

diff --git a/pkg/adapter/nimbus-kubearmor/processor/kspbuilder.go b/pkg/adapter/nimbus-kubearmor/processor/kspbuilder.go
@@ -46,11 +46,28 @@ func buildKspFor(id string) kubearmorv1.KubeArmorPolicy {
 		return swDeploymentToolsKsp()
 	case idpool.UnAuthorizedSaTokenAccess:
 		return unAuthorizedSaTokenAccessKsp()
+	case idpool.DNSManipulation:
+		return dnsManipulationKsp()
 	default:
 		return kubearmorv1.KubeArmorPolicy{}
 	}
 }
 
+func dnsManipulationKsp() kubearmorv1.KubeArmorPolicy {
+	return kubearmorv1.KubeArmorPolicy{
+		Spec: kubearmorv1.KubeArmorPolicySpec{
+			File: kubearmorv1.FileType{
+				MatchPaths: []kubearmorv1.FilePathType{
+					{
+						Path:     "/etc/resolv.conf",
+						ReadOnly: true,
+					},
+				},
+			},
+		},
+	}
+}
+
 func unAuthorizedSaTokenAccessKsp() kubearmorv1.KubeArmorPolicy {
 	return kubearmorv1.KubeArmorPolicy{
 		Spec: kubearmorv1.KubeArmorPolicySpec{