Repository: aquasecurity/starboard
Pull request #359 (2021-01-23 23:04:16)

Set security context for trivy
This PR adds SecurityContexts to the `trivy` Job in order to run the job with the least amount of privilege possible, in partial fulfillment of #163.

I ran the job with and without the changes in a local kind cluster and I did not see a difference in the output.

To obtain the output, I ran:
```
kubectl create deployment nginx --image nginx:1.16
kubectl wait --for=condition=available deploy/nginx --timeout=60s
./bin/starboard scan vulnerabilityreports deployment/nginx
./bin/starboard get vulnerabilities deployment/nginx -o yaml >vulns.yaml
```

---

Looking at issues on the `trivy` repo, I found this issue: https://github.com/aquasecurity/trivy/issues/580, where running as a non-root user was causing `trivy` to be unable to run. It seems that this was due to using the Docker socket, which is not the case in `starboard`, so I don't think this could cause problems here.

codecov[bot]: # [Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/359?src=pr&el=h1) Report
> Merging [#359](https://codecov.io/gh/aquasecurity/starboard/pull/359?src=pr&el=desc) (7b2428d) into [main](https://codecov.io/gh/aquasecurity/starboard/commit/ab281e4060f0f84a2bb0b36c243c283d26f93c02?el=desc) (ab281e4) will **decrease** coverage by `15.46%`.
> The diff coverage is `100.00%`.

[![Impacted file tree graph](https://codecov.io/gh/aquasecurity/starboard/pull/359/graphs/tree.svg?width=650&height=150&src=pr&token=qqTGKAJ0Wb)](https://codecov.io/gh/aquasecurity/starboard/pull/359?src=pr&el=tree)

```diff
@@             Coverage Diff             @@
##             main     #359       +/-   ##
===========================================
- Coverage   66.35%   50.89%   -15.47%     
===========================================
  Files          58       11       -47     
  Lines        3026     1114     -1912     
===========================================
- Hits         2008      567     -1441     
+ Misses        769      471      -298     
+ Partials      249       76      -173     
```


| [Impacted Files](https://codecov.io/gh/aquasecurity/starboard/pull/359?src=pr&el=tree) | Coverage Δ | |
|---|---|---|
| [pkg/trivy/plugin.go](https://codecov.io/gh/aquasecurity/starboard/pull/359/diff?src=pr&el=tree#diff-cGtnL3RyaXZ5L3BsdWdpbi5nbw==) | `47.90% <100.00%> (-25.17%)` | :arrow_down: |
| [pkg/vulnerabilityreport/scanner.go](https://codecov.io/gh/aquasecurity/starboard/pull/359/diff?src=pr&el=tree#diff-cGtnL3Z1bG5lcmFiaWxpdHlyZXBvcnQvc2Nhbm5lci5nbw==) | `0.00% <0.00%> (-75.54%)` | :arrow_down: |
| [pkg/vulnerabilityreport/io.go](https://codecov.io/gh/aquasecurity/starboard/pull/359/diff?src=pr&el=tree#diff-cGtnL3Z1bG5lcmFiaWxpdHlyZXBvcnQvaW8uZ28=) | `30.00% <0.00%> (-53.34%)` | :arrow_down: |
| [pkg/operator/predicate/predicate.go](https://codecov.io/gh/aquasecurity/starboard/pull/359/diff?src=pr&el=tree#diff-cGtnL29wZXJhdG9yL3ByZWRpY2F0ZS9wcmVkaWNhdGUuZ28=) | `85.71% <0.00%> (-9.53%)` | :arrow_down: |
| [pkg/trivy/converter.go](https://codecov.io/gh/aquasecurity/starboard/pull/359/diff?src=pr&el=tree#diff-cGtnL3RyaXZ5L2NvbnZlcnRlci5nbw==) | `81.25% <0.00%> (-9.38%)` | :arrow_down: |
| [pkg/cmd/find.go](https://codecov.io/gh/aquasecurity/starboard/pull/359/diff?src=pr&el=tree#diff-cGtnL2NtZC9maW5kLmdv) | | |
| [pkg/kubehunter/model.go](https://codecov.io/gh/aquasecurity/starboard/pull/359/diff?src=pr&el=tree#diff-cGtnL2t1YmVodW50ZXIvbW9kZWwuZ28=) | | |
| [pkg/cmd/get\_configaudit.go](https://codecov.io/gh/aquasecurity/starboard/pull/359/diff?src=pr&el=tree#diff-cGtnL2NtZC9nZXRfY29uZmlnYXVkaXQuZ28=) | | |
| [pkg/cmd/init.go](https://codecov.io/gh/aquasecurity/starboard/pull/359/diff?src=pr&el=tree#diff-cGtnL2NtZC9pbml0Lmdv) | | |
| ... and [43 more](https://codecov.io/gh/aquasecurity/starboard/pull/359/diff?src=pr&el=tree-more) | |

------

[Continue to review full report at Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/359?src=pr&el=continue).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/359?src=pr&el=footer). Last update [ab281e4...7b2428d](https://codecov.io/gh/aquasecurity/starboard/pull/359?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).


Patch:
diff --git a/pkg/polaris/plugin.go b/pkg/polaris/plugin.go
index 308eed8..e754445 100644
--- a/pkg/polaris/plugin.go
+++ b/pkg/polaris/plugin.go
@@ -93,6 +93,21 @@ func (p *plugin) GetScanJobSpec(workload kube.Object, gvk schema.GroupVersionKin
 					"--config", "/etc/starboard/polaris.config.yaml",
 					"--resource", sourceName,
 				},
+				SecurityContext: &corev1.SecurityContext{
+					Privileged:               pointer.BoolPtr(false),
+					AllowPrivilegeEscalation: pointer.BoolPtr(false),
+					Capabilities: &corev1.Capabilities{
+						Drop: []corev1.Capability{"all"},
+					},
+					ReadOnlyRootFilesystem: pointer.BoolPtr(true),
+				},
+			},
+		},
+		SecurityContext: &corev1.PodSecurityContext{
+			RunAsUser:  pointer.Int64Ptr(1000),
+			RunAsGroup: pointer.Int64Ptr(1000),
+			SeccompProfile: &corev1.SeccompProfile{
+				Type: corev1.SeccompProfileTypeRuntimeDefault,
 			},
 		},
 	}, nil
diff --git a/pkg/trivy/plugin.go b/pkg/trivy/plugin.go
index 0d588f7..7186204 100644
--- a/pkg/trivy/plugin.go
+++ b/pkg/trivy/plugin.go
@@ -250,6 +250,14 @@ func (s *scanner) getPodSpecForStandaloneMode(spec corev1.PodSpec, credentials m
 					MountPath: "/var/lib/trivy",
 				},
 			},
+			SecurityContext: &corev1.SecurityContext{
+				Privileged:               pointer.BoolPtr(false),
+				AllowPrivilegeEscalation: pointer.BoolPtr(false),
+				Capabilities: &corev1.Capabilities{
+					Drop: []corev1.Capability{"all"},
+				},
+				ReadOnlyRootFilesystem: pointer.BoolPtr(true),
+			},
 		})
 	}
 
@@ -269,6 +277,13 @@ func (s *scanner) getPodSpecForStandaloneMode(spec corev1.PodSpec, credentials m
 		},
 		InitContainers: []corev1.Container{initContainer},
 		Containers:     containers,
+		SecurityContext: &corev1.PodSecurityContext{
+			RunAsUser:  pointer.Int64Ptr(1000),
+			RunAsGroup: pointer.Int64Ptr(1000),
+			SeccompProfile: &corev1.SeccompProfile{
+				Type: corev1.SeccompProfileTypeRuntimeDefault,
+			},
+		},
 	}, secrets, nil
 }
 


Test patch:
diff --git a/pkg/polaris/plugin_test.go b/pkg/polaris/plugin_test.go
index c21cc5c..e032733 100644
--- a/pkg/polaris/plugin_test.go
+++ b/pkg/polaris/plugin_test.go
@@ -95,6 +95,21 @@ func TestPlugin_GetScanJobSpec(t *testing.T) {
 							"--config", "/etc/starboard/polaris.config.yaml",
 							"--resource", "default/Deployment.apps/v1/nginx",
 						},
+						SecurityContext: &corev1.SecurityContext{
+							Privileged:               pointer.BoolPtr(false),
+							AllowPrivilegeEscalation: pointer.BoolPtr(false),
+							Capabilities: &corev1.Capabilities{
+								Drop: []corev1.Capability{"all"},
+							},
+							ReadOnlyRootFilesystem: pointer.BoolPtr(true),
+						},
+					},
+				},
+				SecurityContext: &corev1.PodSecurityContext{
+					RunAsUser:  pointer.Int64Ptr(1000),
+					RunAsGroup: pointer.Int64Ptr(1000),
+					SeccompProfile: &corev1.SeccompProfile{
+						Type: corev1.SeccompProfileTypeRuntimeDefault,
 					},
 				},
 			},
diff --git a/pkg/trivy/plugin_test.go b/pkg/trivy/plugin_test.go
index 6811206..2d450aa 100644
--- a/pkg/trivy/plugin_test.go
+++ b/pkg/trivy/plugin_test.go
@@ -168,6 +168,21 @@ func TestScanner_GetScanJobSpec(t *testing.T) {
 								MountPath: "/var/lib/trivy",
 							},
 						},
+						SecurityContext: &corev1.SecurityContext{
+							Privileged:               pointer.BoolPtr(false),
+							AllowPrivilegeEscalation: pointer.BoolPtr(false),
+							Capabilities: &corev1.Capabilities{
+								Drop: []corev1.Capability{"all"},
+							},
+							ReadOnlyRootFilesystem: pointer.BoolPtr(true),
+						},
+					},
+				},
+				SecurityContext: &corev1.PodSecurityContext{
+					RunAsUser:  pointer.Int64Ptr(1000),
+					RunAsGroup: pointer.Int64Ptr(1000),
+					SeccompProfile: &corev1.SeccompProfile{
+						Type: corev1.SeccompProfileTypeRuntimeDefault,
 					},
 				},
 			},