KubeArmor: Policy enforcement failure due to rule conflicts

Let’s say that we have the following policies.

Policy A

process:
  matchPaths:
  - path: /bin/sleep
     fromSource:
     - path: /bin/bash
  action:
    Allow

Policy B

process:
  matchPaths:
  - path: /bin/bash
action:
  Allow

Those policies are converted something like this.

...
/bin/bash cx,
profile /bin/bash {
  /bin/sleep ix,
}
/bin/bash ix,
...

Causing the policy enforcement failure because of two /bin/bash lines.

About this issue

  • Original URL
  • State: closed
  • Created 3 years ago
  • Comments: 18 (14 by maintainers)

Most upvoted comments

@daemon1024 no problem 😃 just for checking.

@daemon1024 Yes, that was what I thought, but I’m wondering if there is no problem when we have such AppArmor rules. If you validate those AppArmor rules before starting the implementation, it would be helpful. Please check if there is no syntax and semantic error.

@daemon1024 I assigned this issue to you.