testcase for bgp container in container hardening

[maipbui]

Description of PR

HLD implementation: Container Hardening (sonic-net/SONiC#1364)
Dependency: sonic-net/sonic-buildimage#14932

Summary:
Fixes # (issue)

Type of change

• Bug fix
• Testbed and Framework(new/improvement)
• Test case(new/improvement)

Back port request

• 201911
• 202012
• 202205

Approach

What is the motivation for this PR?

Check bgp container has access to /dev/sda* or /dev/vda* after limiting privileged flag to less Linux capabilities.

How did you do it?

How did you verify/test it?

container_hardening/test_container_hardening.py::test_bgp_dev PASSED                                                                            [100%]

Any platform specific information?

Supported testbed topology if it's a new test case?

Any topology

Documentation

[mssonicbld]

The pre-commit check detected issues in the files touched by this pull request.
The pre-commit check is a mandatory check, please fix detected issues.

Detailed pre-commit check results:
trim trailing whitespace.................................................Passed
fix end of files.........................................................Failed
- hook id: end-of-file-fixer
- exit code: 1
- files were modified by this hook

Fixing tests/container_hardening/test_container_hardening.py

check yaml...........................................(no files to check)Skipped
check for added large files..............................................Passed
check python ast.........................................................Passed
flake8...................................................................Passed
check conditional mark sort..........................(no files to check)Skipped

To run the pre-commit checks locally, you can follow below steps:

1. Ensure that default python is python3. In sonic-mgmt docker container, default python is python2. You can run
   the check by activating the python3 virtual environment in sonic-mgmt docker container or outside of sonic-mgmt
   docker container.
2. Ensure that the pre-commit package is installed:

sudo pip install pre-commit

3. Go to repository root folder
4. Install the pre-commit hooks:

pre-commit install

5. Use pre-commit to check staged file:

pre-commit

6. Alternatively, you can check committed files using:

pre-commit run --from-ref <commit_id> --to-ref <commit_id>

[qiluo-msft]

what is vda and why grep it? #Closed

[maipbui]

/dev/vda in vs image is similar to /dev/sda

admin@vlab-03:~$ docker exec -it bgp bash -c 'ls /dev | grep vda'
admin@vlab-03:~$ docker exec -it telemetry bash -c 'ls /dev | grep vda'
vda
vda1
vda2
vda3

[qiluo-msft]

It's only working in KVM environments. In most DUT, you want to check /dev/sdaN.
You may find a flexible way to check the main disk device.

[maipbui]

I modified to a more general way to check the device, thanks!

[qiluo-msft]

device

Will you check shell return code, and device is a valid path? If not, there may be risk to be inject into another command. #Closed

[maipbui]

I checked return code and valid path for device

[Yarden-Z]

Is this test related to the --privileged flag removal or net=host?
I think we should mention this and also change the name of the test to accommodate it.
Also - in the future, I think we should make this test generic for any container that wants to test their solution.

[maipbui]

@Yarden-Z it's related to test --privileged flag, I modified the test to make it generic.

[Yarden-Z]

It's a good improvement.
I think that in the future we can make this test even more generic.
i.e - maintain a list of containers that do not have the --privileged flag. (define this list in some global or maintain it in the section of container hardening)
Then - for each container (name) in this list, iterate on top of them and execute this test. That way - we won't need the if case and we'll be able to scale this test for each new container.

[maipbui]

addressed your comment, thanks