Documentation
¶
Overview ¶
Package podsec evaluates pod and container security settings with Kubernetes precedence, so every scanner and admission check that asks the same question gets the same answer.
Index ¶
- func AllowsPrivilegeEscalation(c corev1.Container) bool
- func Containers(pod *corev1.Pod, includeEphemeral bool) []corev1.Container
- func DropsAllCapabilities(c corev1.Container) bool
- func ReadOnlyRootFS(c corev1.Container) bool
- func RunAsNonRoot(pod *corev1.Pod, c corev1.Container) (bool, bool)
- func RunAsUser(pod *corev1.Pod, c corev1.Container) (int64, bool)
- func SeccompConfined(pod *corev1.Pod, c corev1.Container) bool
- type Status
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AllowsPrivilegeEscalation ¶
AllowsPrivilegeEscalation reports whether the container may gain privileges. An unset field is true, and privileged or an added CAP_SYS_ADMIN (or ALL) forces true whatever the field says.
func Containers ¶
Containers returns the pod's init and regular containers, followed by its ephemeral containers converted to Container when includeEphemeral is true. It returns nil for a nil pod.
func DropsAllCapabilities ¶
DropsAllCapabilities reports whether the container drops ALL capabilities, matched without regard to case as container runtimes do. The field exists only on the container.
func ReadOnlyRootFS ¶
ReadOnlyRootFS reports whether the container's root filesystem is read-only. The field exists only on the container and an unset field means writable.
func RunAsNonRoot ¶
RunAsNonRoot returns the effective runAsNonRoot and whether either level sets it. The container value wins when set, else the pod value applies.
func RunAsUser ¶
RunAsUser returns the effective runAsUser and whether either level sets it. The container value wins when set, else the pod value applies.
func SeccompConfined ¶
SeccompConfined reports whether the container runs under a RuntimeDefault or Localhost seccomp profile. The container profile wins when set, Unconfined included, else the pod profile applies, and no profile at either level is not confined.
Types ¶
type Status ¶
type Status string
Status describes what a pod spec settles about the user a container runs as.
const ( // Root means the effective runAsUser is 0. Root Status = "root" // NonRoot means the effective runAsUser is above 0, or it is unset and the effective // runAsNonRoot is true. NonRoot Status = "non-root" // Unknown means the spec does not settle the user, so only the image can. Unknown Status = "unknown" )
Status values. Unknown counts as not non-root for every consumer.
func RootStatus ¶
RootStatus classifies the container's user from the effective runAsUser and runAsNonRoot. An effective runAsUser of 0 is Root even under runAsNonRoot true, since that container cannot run as anything else, and runAsNonRoot false alone is Unknown because false only skips the check.
Source Files