cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: 4c415497-7410-4559-90e8-f2c8ac64ee38.md

title: Root Containers Admitted hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 4c415497-7410-4559-90e8-f2c8ac64ee38 Query name: Root Containers Admitted Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Best Practices URL: Containers must not be allowed to run with root privileges, which means the attributes 'privileged' and 'allowprivilegeescalation' must be set to false, 'runasuser.rule' must be set to 'MustRunAsNonRoot', and adding the root group must be forbidden<br> ```tf title="Positive test num. 1 - tf file" hl_lines="37 6 7 19 27" resource "kubernetespodsecurity_policy" "example" { metadata { name = "terraform-example" } spec { privileged = true allowprivilegeescalation = true volumes = [ "configMap", "emptyDir", "projected", "secret", "downwardAPI", "persistentVolumeClaim", ] runasuser { rule = "RunAsAny" } se_linux { rule = "RunAsAny" } supplemental_groups { rule = "RunAsAny" range { min = 1 max = 65535 } } fs_group { rule = "MustRunAs" range { min = 0 max = 65535 } } } } ``` ```tf title="Negative test num. 1 - tf file" resource "kubernetespodsecurity_policy" "example2" { metadata { name = "terraform-example" } spec { privileged = false allowprivilegeescalation = false volumes = [ "configMap", "emptyDir", "projected", "secret", "downwardAPI", "persistentVolumeClaim", ] runasuser { rule = "MustRunAsNonRoot" } se_linux { rule = "RunAsAny" } supplemental_groups { rule = "MustRunAs" range { min = 1 max = 65535 } } fs_group { rule = "MustRunAs" range { min = 1 max = 65535 } } readonlyroot_filesystem = true } } ```
Project: Podman (App Definition and Development / Application Definition & Image Build)
File: podman-manifest.1.md

% podman-manifest 1 podman\-manifest - Create and manipulate manifest lists and image indexes podman manifest subcommand The `podman manifest` command provides subcommands which can be used to: Create a working Docker manifest list or OCI image index. | Command | Man Page | Description | | -- | | - | | add | | Add an image or artifact to a manifest list or image index. | | annotate | | Add and update information about an image or artifact in a manifest list or image index. | | create | | Create a manifest list or image index. | | exists | | Check if the given manifest list exists in local storage | | inspect | | Display a manifest list or image index. | | push | | Push a manifest list or image index to a registry. | | remove | | Remove an image from a manifest list or image index. | | rm | | Remove manifest list or image index from local storage. | Assuming the `Containerfile` uses `RUN` instructions, the host needs a way to execute non-native binaries. Configuring this is beyond the scope of this example. Building a multi-arch manifest list `shazam` in parallel across 4-threads can be done like this: $ platarch=linux/amd64,linux/ppc64le,linux/arm64,linux/s390x $ podman build --jobs=4 --platform=$platarch --manifest shazam . Note: The `--jobs` argument is optional. Do not use the `podman build` command's `--tag` (or `-t`) option when building a multi-arch manifest list. Assuming `example.com/example/shazam:$arch` images are built separately on other hosts and pushed to the `example.com` registry. They may be combined into a manifest list, and pushed using a simple loop: $ REPO=example.com/example/shazam $ podman manifest create $REPO:latest $ for IMGTAG in amd64 s390x ppc64le arm64; do \ podman manifest add $REPO:latest docker://$REPO:IMGTAG; \ done $ podman manifest push --all $REPO:latest Note: The `add` instruction argument order is `<manifest>` then `<image>`. Also, the `--all` push option is required to ensure all contents are pushed, not just the native platform/arch. Special care is needed when removing and pushing manifest lists, as opposed to the contents. You almost always want to use the `manifest rm` and `manifest push --all` subcommands. For example, a rename and push can be performed like this: $ podman tag localhost/shazam example.com/example/shazam $ podman manifest rm localhost/shazam $ podman manifest push --all example.com/example/shazam , , , , , ,
Project: Falco (Provisioning / Security & Compliance)
File: 20191217-rules-naming-convention.md

<!-- toc --> * * * + <!-- tocstop --> Propose some basic naming conventions when new lists, macros, rules are introduced. We want to help people from the community to contribute to falco rules. It will help improving the security content provided by Falco out of the box. Since people have different preference of naming things, it's necessary to set forth some basic naming convention for people to follow when creating new rules, macros and lists. People will have to follow the naming conventions rules when introducing new Falco rules, macros and lists. There will be no intention to cover Falco rule syntax in this proposal. When new PRs are created in the area of rules, reviewers need to examine whether there are new rules, macros or lists are introduced. If yes, check whether follow the naming convention. N/A Rule Name: Use phrases with capitalizing every word except preposition (e.g. `Search Private Keys or Passwords`) Description: Use sentence always starting with "Detect" and ending with period. (e.g. `Detect grep private keys or passwords activity.`) Output: Use sentence. Must at least include output fields (user=%user.name command=%proc.cmdline container_id=%container.id) Tags: Use at least one of the following: [network, process, filesystem]. Also encourage to use mitre_* tags if applicable Macro Name: Use lowercaseseparatedbyunderscores (e.g. `parentjavarunningzookeeper`) List Name: Use lowercaseseparatedbyunderscores (e.g. `protectedshellspawningbinaries`)
Project: KICS (Provisioning / Security & Compliance)
File: 73c3bc54-3cc6-4c0a-b30a-e19f2abfc951.md

title: Non Body Parameter Without Schema hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 73c3bc54-3cc6-4c0a-b30a-e19f2abfc951 Query name: Non Body Parameter Without Schema Platform: OpenAPI Severity: <span style="color:#5bc0de">Info</span> Category: Structure and Semantics URL: The Body Parameter Object should have the attribute 'schema' defined<br> ```json title="Positive test num. 1 - json file" hl_lines="16 37" { "swagger": "2.0", "info": { "title": "Simple API Overview", "version": "1.0.0" }, "paths": { "/": { "get": { "parameters": [ { "name": "limit2", "in": "query", "description": "max records to return", "required": true, "schema": { "type": "integer" } } ], "operationId": "listVersionsV2", "summary": "List API versions", "responses": { "200": { "description": "200 response" } } } } }, "parameters": { "limitParam": { "name": "limit", "in": "path", "description": "max records to return", "required": true, "schema": { "type": "integer" } } } } ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="26 13" swagger: '2.0' info: title: Simple API Overview version: 1.0.0 paths: "/": get: parameters: name: limit2 in: query description: max records to return required: true schema: type: integer operationId: listVersionsV2 summary: List API versions responses: '200': description: 200 response parameters: limitParam: name: limit in: path description: max records to return required: true schema: type: integer ``` ```json title="Negative test num. 1 - json file" { "swagger": "2.0", "info": { "title": "Simple API Overview", "version": "1.0.0" }, "paths": { "/": { "get": { "parameters": [ { "name": "limit2", "in": "query", "description": "max records to return", "required": true } ], "operationId": "listVersionsV2", "summary": "List API versions", "responses": { "200": { "description": "200 response" } } } } }, "parameters": { "limitParam": { "name": "limit", "in": "path", "description": "max records to return", "required": true } } } ``` ```yaml title="Negative test num. 2 - yaml file" swagger: '2.0' info: title: Simple API Overview version: 1.0.0 paths: "/": get: parameters: name: limit2 in: query description: max records to return required: true operationId: listVersionsV2 summary: List API versions responses: '200': description: 200 response parameters: limitParam: name: limit in: path description: max records to return required: true ```
Project: KICS (Provisioning / Security & Compliance)
File: 03879981-efa2-47a0-a818-c843e1441b88.md

title: EC2 Permissive Network ACL Protocols hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 03879981-efa2-47a0-a818-c843e1441b88 Query name: EC2 Permissive Network ACL Protocols Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Networking and Firewall URL: To avoid opening all ports for Allow rules, EC2 NetworkACL Entry Protocol should be either 6 (for TCP), 17 (for UDP), 1 (for ICMP), or 58 (for ICMPv6, which must include an IPv6 CIDR block, ICMP type, and code).<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="17" AWSTemplateFormatVersion: "2010-09-09" Description: A sample template Resources: MyNACL: Type: AWS::EC2::NetworkAcl Properties: VpcId: vpc-1122334455aabbccd Tags: Key: Name Value: NACLforSSHTraffic OutboundRule: Type: AWS::EC2::NetworkAclEntry Properties: NetworkAclId: Ref: MyNACL RuleNumber: 100 Protocol: -1 Egress: true RuleAction: allow CidrBlock: 0.0.0.0/0 ``` ```json title="Positive test num. 2 - json file" hl_lines="24" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "A sample template", "Resources": { "MyNACL": { "Type": "AWS::EC2::NetworkAcl", "Properties": { "VpcId": "vpc-1122334455aabbccd", "Tags": [ { "Key": "Name", "Value": "NACLforSSHTraffic" } ] } }, "OutboundRule": { "Properties": { "CidrBlock": "0.0.0.0/0", "NetworkAclId": { "Ref": "MyNACL" }, "RuleNumber": 100, "Protocol": -1, "Egress": true, "RuleAction": "allow" }, "Type": "AWS::EC2::NetworkAclEntry" } } } ``` ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: "2010-09-09" Description: A sample template Resources: MyNACL: Type: AWS::EC2::NetworkAcl Properties: VpcId: vpc-1122334455aabbccd Tags: Key: Name Value: NACLforSSHTraffic InboundRule: Type: AWS::EC2::NetworkAclEntry Properties: NetworkAclId: Ref: MyNACL RuleNumber: 100 Protocol: 6 RuleAction: allow CidrBlock: 172.16.0.0/24 PortRange: From: 22 To: 22 ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "A sample template", "Resources": { "InboundRule": { "Type": "AWS::EC2::NetworkAclEntry", "Properties": { "CidrBlock": "172.16.0.0/24", "PortRange": { "To": 22, "From": 22 }, "NetworkAclId": { "Ref": "MyNACL" }, "RuleNumber": 100, "Protocol": 6, "RuleAction": "allow" } }, "MyNACL": { "Properties": { "VpcId": "vpc-1122334455aabbccd", "Tags": [ { "Key": "Name", "Value": "NACLforSSHTraffic" } ] }, "Type": "AWS::EC2::NetworkAcl" } } } ```
Project: RabbitMQ (App Definition and Development / Streaming & Messaging)
File: 3.11.17.md

RabbitMQ `3.11.17` is a maintenance release in the `3.11.x` . Please refer to the upgrade section from if upgrading from a version prior to 3.11.0. This release requires Erlang 25 and supports Erlang versions up to `25.3.x`. has more details on Erlang version requirements for RabbitMQ. As of 3.11.0, RabbitMQ requires Erlang 25. Nodes will fail to start on older Erlang releases. Erlang 25 as our new baseline means much improved performance on ARM64 architectures, across all architectures, and the most recent TLS 1.3 implementation available to all RabbitMQ 3.11 users. Release notes can be found on GitHub at . Fixed two quorum queue federation issues. GitHub issue: Nodes that had a large number of quorum queues could observe accumulation of Erlang processes under significant load. Contributed by @SimonUnge (AWS). GitHub issue: Nodes could hang when recovering classic queue indices during boot. GitHub issue: As of , nodes refuse to start if the definitions file cannot be parsed as valid JSON. Now this also applies to nodes that were configure to skip definition import if the input file(s) has changed using the `definitions.skipifunchanged` setting. GitHub issue: Reduce CPU footprint of quorum queue metric emission in clusters with a lot of quorum queues. Contributed by @SimonUnge (AWS). GitHub issue: The plugin reported the interface were bound to incorrectly. GitHub issue: It is now possible to change default queue type for a virtual host using the `PUT /api/vhosts/{name}` endpoint. GitHub issue: The plugin reported the interface its listener(s) were bound to incorrectly. GitHub issue: The plugin reported the interface its listener(s) were bound to incorrectly. GitHub issue: Make-based source package builds were failing in an offline environment. GitHub issue: Make-based source package builds were failing in an offline environment. GitHub issue: used by CLI tools was upgraded to `3.0.5` To obtain source code of the entire distribution, please download the archive named `rabbitmq-server-3.11.17.tar.xz` instead of the source tarball produced by GitHub.
Project: Stolon (App Definition and Development / Database)
File: stolonctl_clusterdata.md

Manage current cluster data Manage current cluster data ``` -h, --help help for clusterdata ``` ``` --cluster-name string cluster name --kube-context string name of the kubeconfig context to use --kube-namespace string name of the kubernetes namespace to use --kube-resource-kind string the k8s resource kind to be used to store stolon clusterdata and do sentinel leader election (only "configmap" is currently supported) --kubeconfig string path to kubeconfig file. Overrides $KUBECONFIG --log-level string debug, info (default), warn or error (default "info") --metrics-listen-address string metrics listen address i.e "0.0.0.0:8080" (disabled by default) --store-backend string store backend type (etcdv2/etcd, etcdv3, consul or kubernetes) --store-ca-file string verify certificates of HTTPS-enabled store servers using this CA bundle --store-cert-file string certificate file for client identification to the store --store-endpoints string a comma-delimited list of store endpoints (use https scheme for tls communication) (defaults: http://127.0.0.1:2379 for etcd, http://127.0.0.1:8500 for consul) --store-key string private key file for client identification to the store --store-prefix string the store base prefix (default "stolon/cluster") --store-skip-tls-verify skip store certificate verification (insecure!!!) --store-timeout duration store request timeout (default 5s) ``` - stolon command line client - Retrieve the current cluster data - Write cluster data
Project: Meshery (Provisioning / Automation & Configuration)
File: v0.6.108.md

layout: release date: 2023-07-14 tag: v0.6.108 [Server] API for dynamic component registration @MUzairS15 (#8132) Fix: the schema doesn't have model name correctly depicted @Abhishek-kumar09 (#8155) Remove mesheryctl filter from experimental @abdullah1308 (#8169) [chore] custom annotations to grid differently , rjsf custom select widget @harkiratsm (#8165) chore: update link to wireframes and designs for Meshery UI in Figma @rupeshshandilya (#8166) Add SVG in meshmodel docs @Boombag0607 (#8160) [CI] Update workflow usage of component_updater script @theBeginner86 (#8152) Fixing intra-page anchor issue in meshery docs @yash37158 (#8151) [mesheryctl] Docs: Remove `apply`, add `import`, promote from experimental @leecalcote (#8170) Add SVG in meshmodel docs @Boombag0607 (#8160) Thank you to our contributors for making this release possible: @Abhishek-kumar09, @Boombag0607, @MUzairS15, @abdullah1308, @harkiratsm, @l5io, @leecalcote, @rupeshshandilya, @theBeginner86, @yash37158 and l5io
Project: Trivy (Provisioning / Security & Compliance)
File: testing.md

It is highly recommended to write tests for your custom checks. To help you verify the correctness of your custom checks, OPA gives you a framework that you can use to write tests for your checks. By writing tests for your custom checks you can speed up the development process of new rules and reduce the amount of time it takes to modify rules as requirements evolve. For more details, see . !!! example ``` package user.dockerfile.ID002 testadddenied { r := deny with input as {"stages": {"alpine:3.13": [ {"Cmd": "add", "Value": ["/target/resources.tar.gz", "resources.jar"]}, {"Cmd": "add", "Value": ["/target/app.jar", "app.jar"]}, ]}} count(r) == 1 r[_] == "Consider using 'COPY /target/app.jar app.jar' command instead of 'ADD /target/app.jar app.jar'" } ``` To write tests for custom checks, you can refer to existing tests under . which is a core library of Trivy can be imported as a Go library. You can scan config files in Go and test your custom checks using Go's testing methods, such as . This allows you to use the actual configuration file as input, making it easy to prepare test data and ensure that your custom checks work in practice. In particular, Dockerfile and HCL need to be converted to structural data as input, which may be different from the expected input format. !!! tip We recommend writing OPA and Go tests both since they have different roles, like unit tests and integration tests. The following example stores allowed and denied configuration files in a directory. `Successes` contains the result of successes, and `Failures` contains the result of failures. ``` go { name: "disallowed ports", input: "configs/", fields: fields{ policyPaths: []string{"policy"}, dataPaths: []string{"data"}, namespaces: []string{"user"}, }, want: []types.Misconfiguration{ { FileType: types.Dockerfile, FilePath: "Dockerfile.allowed", Successes: types.MisconfResults{ { Namespace: "user.dockerfile.ID002", PolicyMetadata: types.PolicyMetadata{ ID: "ID002", Type: "Docker Custom Check", Title: "Disallowed ports exposed", Severity: "HIGH", }, }, }, }, { FileType: types.Dockerfile, FilePath: "Dockerfile.denied", Failures: types.MisconfResults{ { Namespace: "user.dockerfile.ID002", Message: "Port 23 should not be exposed", PolicyMetadata: types.PolicyMetadata{ ID: "ID002", Type: "Docker Custom Check", Title: "Disallowed ports exposed", Severity: "HIGH", }, }, }, }, }, }, ``` `Dockerfile.allowed` has one successful result in `Successes`, while `Dockerfile.denied` has one failure result in `Failures`.
Project: Apache Hadoop (App Definition and Development / Database)
File: s3n.md

<! Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. See accompanying LICENSE file. --> <!-- MACRO{toc|fromDepth=0|toDepth=5} --> S3N was a Hadoop filesystem client which can read or write data stored in Amazon S3. It uses URLs with the schema `s3n://`. - - Hadoop's S3N client for Amazon S3 has been superceded by the S3A connector Please upgrade to S3A for a supported, higher-performance S3 Client - - Keep the `hadoop-aws` JAR on your classpath. Add the `aws-java-sdk-bundle.jar` JAR which Hadoop ships with to your classpath. Change the authentication keys | old key | new key | ||| | `fs.s3n.awsAccessKeyId` | `fs.s3a.access.key` | | `fs.s3n.awsSecretAccessKey` | `fs.s3a.secret.key` | Do make sure the property names are correct. For S3A, they are `fs.s3a.access.key` and `fs.s3a.secret.key` you cannot just copy the S3N properties and replace `s3n` with `s3a`. Replace URLs which began with `s3n://` with `s3a://` You may now remove the `jets3t` JAR, as it is no longer needed.
Project: Seata (App Definition and Development / Database)
File: 1.6.1.md

| <details> <summary><mark>Release notes</mark></summary> Seata 1.6.1 Released. Seata is an easy-to-use, high-performance, open source distributed transaction solution. The version is updated as follows: ] support for `spring-boot:3.x` ] fix ClassNotFoundException when server starts using Eureka ] unify the format of configuration items in yml files ] GlobalTransactionScanner,SeataAutoDataSourceProxyCreator declare @bean methods as static ] fix some security vulnerabilities in GGEditor ] optimize the default values for some switches Thanks to these contributors for their code commits. Please report an unintended omission. <!-- Please make sure your Github ID is in the list below --> Also, we receive many valuable issues, questions and advices from our community. Thanks for you all. Seata: https://github.com/seata/seata Seata-Samples: https://github.com/seata/seata-samples Release: https://github.com/seata/seata/releases WebSite: https://seata.io </details>
Project: ShardingSphere (App Definition and Development / Database)
File: count-broadcast-rule.en.md

+++ title = "COUNT BROADCAST RULE" weight = 2 +++ The `COUNT BROADCAST RULE` syntax is used to query the number of broadcast table rules for specified database. {{< tabs >}} {{% tab name="Grammar" %}} ```sql CountBroadcastRule::= 'COUNT' 'BROADCAST' 'RULE' ('FROM' databaseName)? databaseName ::= identifier ``` {{% /tab %}} {{% tab name="Railroad diagram" %}} <iframe frameborder="0" name="diagram" id="diagram" width="100%" height="100%"></iframe> {{% /tab %}} {{< /tabs >}} When `databaseName` is not specified, the default is the currently used `DATABASE`. If `DATABASE` is not used, `No database selected` will be prompted. | Column | Description | |--|-| | rule_name | rule type | | database | the database to which the rule belongs | | count | the number of the rule | Query the number of broadcast table rules for specified database. ```sql COUNT BROADCAST RULE FROM sharding_db; ``` ```sql mysql> COUNT BROADCAST RULE FROM sharding_db; +--+-+-+ | rule_name | database | count | +--+-+-+ | broadcasttable | shardingdb | 0 | +--+-+-+ 1 rows in set (0.00 sec) ``` Query the number of broadcast table rules for current database. ```sql COUNT BROADCAST RULE; ``` ```sql mysql> COUNT BROADCAST RULE; +--+-+-+ | rule_name | database | count | +--+-+-+ | broadcasttable | shardingdb | 0 | +--+-+-+ 1 rows in set (0.00 sec) ``` `COUNT`, `BROADCAST`, `RULE`, `FROM`
Project: Athenz (Provisioning / Key Management)
File: local_athenz_on_docker.md

In this introduction to Athenz, you will be able to run Athenz on your workstation. Docker Git Make toolset Checkout Athenz from Github ```shell git clone https://github.com/AthenZ/athenz.git ``` `cd` to checked out directory and run following command: ```shell cd athenz && ./start-local-athenz.sh ``` This script will - download Athenz components docker images from DockerHub generate self-signed certificates to be used by Athenz components configure Athenz with meaningful defaults suitable for local environment ( for production set up, please refer to "Production set up" section of docs.) start local containers corresponding to Athenz components (ZMS, ZMS DB, ZTS, ZTS DB, UI) !!! Note If you are using MacOS, then the script prints out a command at the end, which you can execute to add the generated self-signed certificate to your login keychain so that you can access Athenz UI in the browser without certificate warning. If you don't want to do that, please follow appropriate instructions for your workstation and / or browser so that you can access Athenz UI in the browser. Access the UI at https://localhost. For your convenience local set up uses a TestUserAuthority which accepts any username and password as far as it's a same string. To look at a pre-created "athenz" domain during start up, login with "athenz-admin" as username and password.