Skip to content

Instantly share code, notes, and snippets.

@lobuhi

lobuhi/gist:0e2d761ae0c0d8a8bb11fa20c4aee025

Created February 2, 2024 12:41
Show Gist options
  • Save lobuhi/0e2d761ae0c0d8a8bb11fa20c4aee025 to your computer and use it in GitHub Desktop.
Save lobuhi/0e2d761ae0c0d8a8bb11fa20c4aee025 to your computer and use it in GitHub Desktop.
Download ZIP
Kyverno Validation Policy for CVE-2024-21626
Raw
gistfile1.txt
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: disallow-proc-self-fd-workingdir
spec:
validationFailureAction: enforce
background: true
rules:
- name: check-workingDir
match:
resources:
kinds:
- Pod
validate:
message: "Using /proc/self/fd in workingDir is not allowed."
pattern:
spec:
containers:
- =(workingDir): "!/proc/self/fd*"
initContainers:
- =(workingDir): "!/proc/self/fd*"
ephemeralContainers:
- =(workingDir): "!/proc/self/fd*"
@mhemken-vts
Copy link

The above flags all pods. This fixes that bug.

          spec:
            containers:
              - =(workingDir): "!/proc/self/fd*"
            "=(initContainers)":
              - =(workingDir): "!/proc/self/fd*"
            "=(ephemeralContainers)":
              - =(workingDir): "!/proc/self/fd*"

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment