Project: KubeArmor (Provisioning / Security & Compliance)
File: vagrant-selinux.md

Environment Setup To test KubeArmor for the SELinux-enabled environment, please run the following commands. ```text $ cd KubeArmor/KubeArmor ~/KubeArmor/KubeArmor $ make vagrant-up OS=centos ``` Preparation To test host policies, please run the following commands. ```text $ cd KubeArmor/KubeArmor ~/KubeArmor/KubeArmor $ make vagrant-ssh (vagrant) $ cd KubeArmor/examples/vagrant-selinux (vagrant...vagrant-selinux) $ ./copy.sh ``` Test To verify KubeArmor's functionalities, we provide sample host security policies. ```text (vagrant) $ cd selinux-test/policies (vagrant...policies) $ ls hsp-kubearmor-dev-proc-path-block.yaml hsp-kubearmor-dev-proc-path-allow-fromSource.yaml hsp-kubearmor-dev-proc-path-block-fromSource.yaml hsp-kubearmor-dev-file-path-block.yaml hsp-kubearmor-dev-file-path-allow-fromSource.yaml hsp-kubearmor-dev-file-path-allow-fromSource-readOnly.yaml hsp-kubearmor-dev-file-path-block-fromSource.yaml hsp-kubearmor-dev-file-path-block-fromSource-readOnly.yaml hsp-kubearmor-dev-file-dir-allow-fromSource.yaml hsp-kubearmor-dev-file-dir-block-fromSource.yaml ``` We also provide instructions to test each policy. hsp-kubearmor-dev-proc-path-block.yaml ```text apiVersion: security.kubearmor.com/v1 kind: KubeArmorHostPolicy metadata: name: hsp-kubearmor-dev-proc-path-block spec: nodeSelector: matchLabels: kubernetes.io/hostname: kubearmor-dev severity: 5 process: matchPaths: path: /home/vagrant/selinux-test/read action: Block ``` ```text ``` hsp-kubearmor-dev-proc-path-allow-fromSource.yaml ```text apiVersion: security.kubearmor.com/v1 kind: KubeArmorHostPolicy metadata: name: hsp-kubearmor-dev-proc-path-allow-fromsource spec: nodeSelector: matchLabels: kubernetes.io/hostname: kubearmor-dev severity: 5 process: matchPaths: path: /home/vagrant/selinux-test/write fromSource: path: /home/vagrant/selinux-test/bash action: Allow ``` ```text ``` hsp-kubearmor-dev-proc-path-block-fromSource.yaml ```text apiVersion: security.kubearmor.com/v1 kind: KubeArmorHostPolicy metadata: name: hsp-kubearmor-dev-proc-path-block-fromsource spec: nodeSelector: matchLabels: kubernetes.io/hostname: kubearmor-dev severity: 5 process: matchPaths: path: /home/vagrant/selinux-test/write fromSource: path: /home/vagrant/selinux-test/bash action: Block ``` ```text ``` hsp-kubearmor-dev-file-path-block.yaml ```text apiVersion: security.kubearmor.com/v1 kind: KubeArmorHostPolicy metadata: name: hsp-kubearmor-dev-file-path-block spec: nodeSelector: matchLabels: kubernetes.io/hostname: kubearmor-dev severity: 5 file: matchPaths: path: /home/vagrant/selinux-test/file.txt action: Block ``` ```text ``` hsp-kubearmor-dev-file-path-allow-fromSource.yaml ```text apiVersion: security.kubearmor.com/v1 kind: KubeArmorHostPolicy metadata: name: hsp-kubearmor-dev-file-path-allow-fromsource spec: nodeSelector: matchLabels: kubernetes.io/hostname: kubearmor-dev severity: 5 file: matchPaths: path: /home/vagrant/selinux-test/file.txt fromSource: path: /home/vagrant/selinux-test/read action: Allow ``` ```text ``` hsp-kubearmor-dev-file-path-allow-fromSource-readOnly.yaml ```text apiVersion: security.kubearmor.com/v1 kind: KubeArmorHostPolicy metadata: name: hsp-kubearmor-dev-file-path-block-fromsource-readonly spec: nodeSelector: matchLabels: kubernetes.io/hostname: kubearmor-dev severity: 5 file: matchPaths: path: /home/vagrant/selinux-test/file.txt readOnly: true fromSource: path: /home/vagrant/selinux-test/readwrite action: Block ``` ```text ``` hsp-kubearmor-dev-file-path-block-fromSource.yaml ```text apiVersion: security.kubearmor.com/v1 kind: KubeArmorHostPolicy metadata: name: hsp-kubearmor-dev-file-path-block-fromsource spec: nodeSelector: matchLabels: kubernetes.io/hostname: kubearmor-dev severity: 5 file: matchPaths: path: /home/vagrant/selinux-test/file.txt fromSource: path: /home/vagrant/selinux-test/read action: Block ``` ```text ``` hsp-kubearmor-dev-file-path-block-fromSource-readOnly.yaml ```text apiVersion: security.kubearmor.com/v1 kind: KubeArmorHostPolicy metadata: name: hsp-kubearmor-dev-file-path-block-fromsource-readonly spec: nodeSelector: matchLabels: kubernetes.io/hostname: kubearmor-dev severity: 5 file: matchPaths: path: /home/vagrant/selinux-test/file.txt readOnly: true fromSource: path: /home/vagrant/selinux-test/readwrite action: Block ``` ```text ``` hsp-kubearmor-dev-file-dir-allow-fromSource.yaml ```text apiVersion: security.kubearmor.com/v1 kind: KubeArmorHostPolicy metadata: name: hsp-kubearmor-dev-file-dir-allow-fromsource spec: nodeSelector: matchLabels: kubernetes.io/hostname: kubearmor-dev severity: 5 file: matchDirectories: dir: /home/vagrant/selinux-test/matchDir/ recursive: true fromSource: path: /home/vagrant/selinux-test/read action: Allow ``` ```text ``` hsp-kubearmor-dev-file-dir-block-fromSource.yaml ```text apiVersion: security.kubearmor.com/v1 kind: KubeArmorHostPolicy metadata: name: hsp-kubearmor-dev-file-dir-block-fromsource spec: nodeSelector: matchLabels: kubernetes.io/hostname: kubearmor-dev severity: 5 file: matchDirectories: dir: /home/vagrant/selinux-test/matchDir/ fromSource: path: /home/vagrant/selinux-test/read action: Block ``` ```text ```