Skip to content

Commit 0140c2d

Browse files
author
OpenShift Bot
authored
Merge pull request #15116 from php-coder/refactor_scc_points
Merged by openshift-bot
2 parents 18bb64e + 883832c commit 0140c2d

File tree

2 files changed

+84
-59
lines changed

2 files changed

+84
-59
lines changed

‎pkg/security/scc/byrestrictions.go

Lines changed: 55 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
package scc
22

33
import (
4+
"github.com/golang/glog"
5+
46
securityapi "github.com/openshift/origin/pkg/security/apis/security"
57
)
68

@@ -15,46 +17,73 @@ func (s ByRestrictions) Less(i, j int) bool {
1517
return pointValue(s[i]) < pointValue(s[j])
1618
}
1719

20+
// The following constants define the weight of the restrictions and used for
21+
// calculating the points of the particular SCC. The lower the number, the more
22+
// restrictive SCC is. Make sure that weak restrictions are always valued
23+
// higher than the combination of the strong restrictions.
24+
25+
type points int
26+
27+
const (
28+
privilegedPoints points = 20
29+
30+
hostVolumePoints points = 10
31+
nonTrivialVolumePoints points = 5
32+
33+
runAsAnyUserPoints points = 4
34+
runAsNonRootPoints points = 3
35+
runAsRangePoints points = 2
36+
runAsUserPoints points = 1
37+
38+
noPoints points = 0
39+
)
40+
1841
// pointValue places a value on the SCC based on the settings of the SCC that can be used
1942
// to determine how restrictive it is. The lower the number, the more restrictive it is.
20-
func pointValue(constraint *securityapi.SecurityContextConstraints) int {
21-
points := 0
43+
func pointValue(constraint *securityapi.SecurityContextConstraints) points {
44+
totalPoints := noPoints
2245

23-
// make sure these are always valued higher than the combination of the highest strategies
2446
if constraint.AllowPrivilegedContainer {
25-
points += 20
47+
totalPoints += privilegedPoints
2648
}
2749

2850
// add points based on volume requests
29-
points += volumePointValue(constraint)
30-
31-
// strategies in order of least restrictive to most restrictive
32-
switch constraint.SELinuxContext.Type {
33-
case securityapi.SELinuxStrategyRunAsAny:
34-
points += 4
35-
case securityapi.SELinuxStrategyMustRunAs:
36-
points += 1
51+
totalPoints += volumePointValue(constraint)
52+
53+
// the map contains points for both RunAsUser and SELinuxContext
54+
// strategies by taking advantage that they have identical strategy names
55+
strategiesPoints := map[string]points{
56+
string(securityapi.RunAsUserStrategyRunAsAny): runAsAnyUserPoints,
57+
string(securityapi.RunAsUserStrategyMustRunAsNonRoot): runAsNonRootPoints,
58+
string(securityapi.RunAsUserStrategyMustRunAsRange): runAsRangePoints,
59+
string(securityapi.RunAsUserStrategyMustRunAs): runAsUserPoints,
3760
}
3861

39-
switch constraint.RunAsUser.Type {
40-
case securityapi.RunAsUserStrategyRunAsAny:
41-
points += 4
42-
case securityapi.RunAsUserStrategyMustRunAsNonRoot:
43-
points += 3
44-
case securityapi.RunAsUserStrategyMustRunAsRange:
45-
points += 2
46-
case securityapi.RunAsUserStrategyMustRunAs:
47-
points += 1
62+
strategyType := string(constraint.SELinuxContext.Type)
63+
points, found := strategiesPoints[strategyType]
64+
if found {
65+
totalPoints += points
66+
} else {
67+
glog.Warningf("SELinuxContext type %q has no point value, this may cause issues in sorting SCCs by restriction", strategyType)
4868
}
49-
return points
69+
70+
strategyType = string(constraint.RunAsUser.Type)
71+
points, found = strategiesPoints[strategyType]
72+
if found {
73+
totalPoints += points
74+
} else {
75+
glog.Warningf("RunAsUser type %q has no point value, this may cause issues in sorting SCCs by restriction", strategyType)
76+
}
77+
78+
return totalPoints
5079
}
5180

5281
// volumePointValue returns a score based on the volumes allowed by the SCC.
5382
// Allowing a host volume will return a score of 10. Allowance of anything other
5483
// than Secret, ConfigMap, EmptyDir, DownwardAPI, Projected, and None will result in
5584
// a score of 5. If the SCC only allows these trivial types, it will have a
5685
// score of 0.
57-
func volumePointValue(scc *securityapi.SecurityContextConstraints) int {
86+
func volumePointValue(scc *securityapi.SecurityContextConstraints) points {
5887
hasHostVolume := false
5988
hasNonTrivialVolume := false
6089
for _, v := range scc.Volumes {
@@ -75,10 +104,10 @@ func volumePointValue(scc *securityapi.SecurityContextConstraints) int {
75104
}
76105

77106
if hasHostVolume {
78-
return 10
107+
return hostVolumePoints
79108
}
80109
if hasNonTrivialVolume {
81-
return 5
110+
return nonTrivialVolumePoints
82111
}
83-
return 0
112+
return noPoints
84113
}

‎pkg/security/scc/byrestrictions_test.go

Lines changed: 29 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -8,34 +8,28 @@ import (
88

99
func TestPointValue(t *testing.T) {
1010
newSCC := func(priv bool, seLinuxStrategy securityapi.SELinuxContextStrategyType, userStrategy securityapi.RunAsUserStrategyType) *securityapi.SecurityContextConstraints {
11-
scc := &securityapi.SecurityContextConstraints{
11+
return &securityapi.SecurityContextConstraints{
12+
AllowPrivilegedContainer: priv,
1213
SELinuxContext: securityapi.SELinuxContextStrategyOptions{
1314
Type: seLinuxStrategy,
1415
},
1516
RunAsUser: securityapi.RunAsUserStrategyOptions{
1617
Type: userStrategy,
1718
},
1819
}
19-
if priv {
20-
scc.AllowPrivilegedContainer = true
21-
}
22-
23-
return scc
2420
}
2521

26-
seLinuxStrategies := map[securityapi.SELinuxContextStrategyType]int{
27-
securityapi.SELinuxStrategyRunAsAny: 4,
28-
securityapi.SELinuxStrategyMustRunAs: 1,
22+
seLinuxStrategies := map[securityapi.SELinuxContextStrategyType]points{
23+
securityapi.SELinuxStrategyRunAsAny: runAsAnyUserPoints,
24+
securityapi.SELinuxStrategyMustRunAs: runAsUserPoints,
2925
}
30-
userStrategies := map[securityapi.RunAsUserStrategyType]int{
31-
securityapi.RunAsUserStrategyRunAsAny: 4,
32-
securityapi.RunAsUserStrategyMustRunAsNonRoot: 3,
33-
securityapi.RunAsUserStrategyMustRunAsRange: 2,
34-
securityapi.RunAsUserStrategyMustRunAs: 1,
26+
userStrategies := map[securityapi.RunAsUserStrategyType]points{
27+
securityapi.RunAsUserStrategyRunAsAny: runAsAnyUserPoints,
28+
securityapi.RunAsUserStrategyMustRunAsNonRoot: runAsNonRootPoints,
29+
securityapi.RunAsUserStrategyMustRunAsRange: runAsRangePoints,
30+
securityapi.RunAsUserStrategyMustRunAs: runAsUserPoints,
3531
}
3632

37-
privilegedPoints := 20
38-
3933
// run through all combos of user strategy + seLinux strategy + priv
4034
for userStrategy, userStrategyPoints := range userStrategies {
4135
for seLinuxStrategy, seLinuxStrategyPoints := range seLinuxStrategies {
@@ -61,7 +55,9 @@ func TestPointValue(t *testing.T) {
6155
scc := newSCC(false, securityapi.SELinuxStrategyMustRunAs, securityapi.RunAsUserStrategyMustRunAs)
6256
scc.Volumes = []securityapi.FSType{securityapi.FSTypeHostPath}
6357
actualPoints := pointValue(scc)
64-
if actualPoints != 12 { //1 (SELinux) + 1 (User) + 10 (host path volume)
58+
// SELinux + User + host path volume
59+
expectedPoints := runAsUserPoints + runAsUserPoints + hostVolumePoints
60+
if actualPoints != expectedPoints {
6561
t.Errorf("volume score was not added to the scc point value correctly!")
6662
}
6763
}
@@ -90,79 +86,79 @@ func TestVolumePointValue(t *testing.T) {
9086

9187
tests := map[string]struct {
9288
scc *securityapi.SecurityContextConstraints
93-
expectedPoints int
89+
expectedPoints points
9490
}{
9591
"all volumes": {
9692
scc: allowAllSCC,
97-
expectedPoints: 10,
93+
expectedPoints: hostVolumePoints,
9894
},
9995
"host volume": {
10096
scc: newSCC(true, false, false),
101-
expectedPoints: 10,
97+
expectedPoints: hostVolumePoints,
10298
},
10399
"host volume and non trivial volumes": {
104100
scc: newSCC(true, true, false),
105-
expectedPoints: 10,
101+
expectedPoints: hostVolumePoints,
106102
},
107103
"host volume, non trivial, and trivial": {
108104
scc: newSCC(true, true, true),
109-
expectedPoints: 10,
105+
expectedPoints: hostVolumePoints,
110106
},
111107
"non trivial": {
112108
scc: newSCC(false, true, false),
113-
expectedPoints: 5,
109+
expectedPoints: nonTrivialVolumePoints,
114110
},
115111
"non trivial and trivial": {
116112
scc: newSCC(false, true, true),
117-
expectedPoints: 5,
113+
expectedPoints: nonTrivialVolumePoints,
118114
},
119115
"trivial": {
120116
scc: newSCC(false, false, true),
121-
expectedPoints: 0,
117+
expectedPoints: noPoints,
122118
},
123119
"trivial - secret": {
124120
scc: &securityapi.SecurityContextConstraints{
125121
Volumes: []securityapi.FSType{securityapi.FSTypeSecret},
126122
},
127-
expectedPoints: 0,
123+
expectedPoints: noPoints,
128124
},
129125
"trivial - configMap": {
130126
scc: &securityapi.SecurityContextConstraints{
131127
Volumes: []securityapi.FSType{securityapi.FSTypeConfigMap},
132128
},
133-
expectedPoints: 0,
129+
expectedPoints: noPoints,
134130
},
135131
"trivial - emptyDir": {
136132
scc: &securityapi.SecurityContextConstraints{
137133
Volumes: []securityapi.FSType{securityapi.FSTypeEmptyDir},
138134
},
139-
expectedPoints: 0,
135+
expectedPoints: noPoints,
140136
},
141137
"trivial - downwardAPI": {
142138
scc: &securityapi.SecurityContextConstraints{
143139
Volumes: []securityapi.FSType{securityapi.FSTypeDownwardAPI},
144140
},
145-
expectedPoints: 0,
141+
expectedPoints: noPoints,
146142
},
147143
"trivial - projected": {
148144
scc: &securityapi.SecurityContextConstraints{
149145
Volumes: []securityapi.FSType{securityapi.FSProjected},
150146
},
151-
expectedPoints: 0,
147+
expectedPoints: noPoints,
152148
},
153149
"trivial - none": {
154150
scc: &securityapi.SecurityContextConstraints{
155151
Volumes: []securityapi.FSType{securityapi.FSTypeNone},
156152
},
157-
expectedPoints: 0,
153+
expectedPoints: noPoints,
158154
},
159155
"no volumes allowed": {
160156
scc: newSCC(false, false, false),
161-
expectedPoints: 0,
157+
expectedPoints: noPoints,
162158
},
163159
"nil volumes": {
164160
scc: nilVolumeSCC,
165-
expectedPoints: 0,
161+
expectedPoints: noPoints,
166162
},
167163
}
168164
for k, v := range tests {

0 commit comments

Comments
 (0)