diff --git a/antora/docs/modules/ROOT/pages/packages/release_buildah_build_task.adoc b/antora/docs/modules/ROOT/pages/packages/release_buildah_build_task.adoc index 1e8862318..a6aa2f5bd 100644 --- a/antora/docs/modules/ROOT/pages/packages/release_buildah_build_task.adoc +++ b/antora/docs/modules/ROOT/pages/packages/release_buildah_build_task.adoc @@ -24,7 +24,7 @@ Verify the ADD_CAPABILITIES parameter of a builder Tasks was not used. [#buildah_build_task__malformed_parameter] === link:#buildah_build_task__malformed_parameter[Build task parameters are well-formed] -Verify that the DOCKERFILE, ADD_CAPABILITIES, PLATFORM and PRIVILEGED_NESTED parameters of a builder Task, when present, are provided as strings. A non-string value (null, number, object or array), or a malformed parameter container that hides the parameters entirely, would otherwise be silently ignored by the parameter checks, allowing a malformed value to look like a pass. +Verify that the DOCKERFILE, ADD_CAPABILITIES and PLATFORM parameters of a builder Task, when present, are provided as strings. A non-string value (null, number, object or array), or a malformed parameter container that hides the parameters entirely, would otherwise be silently ignored by the parameter checks, allowing a malformed value to look like a pass. *Solution*: Provide the parameter as a string value, or unset it if it is optional. @@ -32,7 +32,7 @@ Verify that the DOCKERFILE, ADD_CAPABILITIES, PLATFORM and PRIVILEGED_NESTED par * FAILURE message: `%s` * Code: `buildah_build_task.malformed_parameter` * Effective from: `2027-01-11T00:00:00Z` -* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/buildah_build_task/buildah_build_task.rego#L125[Source, window="_blank"] +* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/buildah_build_task/buildah_build_task.rego#L102[Source, window="_blank"] [#buildah_build_task__buildah_uses_local_dockerfile] === link:#buildah_build_task__buildah_uses_local_dockerfile[Buildah task uses a local Dockerfile] @@ -59,18 +59,6 @@ Verify the value of the PLATFORM parameter of a builder Task is allowed by match * Effective from: `2024-09-01T00:00:00Z` * https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/buildah_build_task/buildah_build_task.rego#L63[Source, window="_blank"] -[#buildah_build_task__privileged_nested_param] -=== link:#buildah_build_task__privileged_nested_param[PRIVILEGED_NESTED parameter] - -Verify the PRIVILEGED_NESTED parameter of a builder Tasks was not set to `true`. - -*Solution*: Setting PRIVILEGED_NESTED parameter to true is not allowed for most container image builds. Either set the parameter value to false or use a policy config that excludes this policy rule. - -* Rule type: [rule-type-indicator failure]#FAILURE# -* FAILURE message: `setting PRIVILEGED_NESTED parameter to true is not allowed` -* Code: `buildah_build_task.privileged_nested_param` -* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/buildah_build_task/buildah_build_task.rego#L102[Source, window="_blank"] - [#buildah_build_task__disallowed_platform_patterns_pattern] === link:#buildah_build_task__disallowed_platform_patterns_pattern[disallowed_platform_patterns format] diff --git a/antora/docs/modules/ROOT/pages/release_policy.adoc b/antora/docs/modules/ROOT/pages/release_policy.adoc index 4c06f19dd..109a44c58 100644 --- a/antora/docs/modules/ROOT/pages/release_policy.adoc +++ b/antora/docs/modules/ROOT/pages/release_policy.adoc @@ -127,7 +127,6 @@ Rules included: * xref:packages/release_buildah_build_task.adoc#buildah_build_task__malformed_parameter[Buildah build task: Build task parameters are well-formed] * xref:packages/release_buildah_build_task.adoc#buildah_build_task__buildah_uses_local_dockerfile[Buildah build task: Buildah task uses a local Dockerfile] * xref:packages/release_buildah_build_task.adoc#buildah_build_task__platform_param[Buildah build task: PLATFORM parameter] -* xref:packages/release_buildah_build_task.adoc#buildah_build_task__privileged_nested_param[Buildah build task: PRIVILEGED_NESTED parameter] * xref:packages/release_buildah_build_task.adoc#buildah_build_task__disallowed_platform_patterns_pattern[Buildah build task: disallowed_platform_patterns format] * xref:packages/release_cve.adoc#cve__cve_blockers[CVE checks: Blocking CVE check] * xref:packages/release_cve.adoc#cve__unpatched_cve_blockers[CVE checks: Blocking unpatched CVE check] @@ -365,7 +364,6 @@ Rules included: * xref:packages/release_buildah_build_task.adoc#buildah_build_task__add_capabilities_param[Buildah build task: ADD_CAPABILITIES parameter] * xref:packages/release_buildah_build_task.adoc#buildah_build_task__malformed_parameter[Buildah build task: Build task parameters are well-formed] * xref:packages/release_buildah_build_task.adoc#buildah_build_task__buildah_uses_local_dockerfile[Buildah build task: Buildah task uses a local Dockerfile] -* xref:packages/release_buildah_build_task.adoc#buildah_build_task__privileged_nested_param[Buildah build task: PRIVILEGED_NESTED parameter] * xref:packages/release_cve.adoc#cve__cve_blockers[CVE checks: Blocking CVE check] * xref:packages/release_cve.adoc#cve__unpatched_cve_blockers[CVE checks: Blocking unpatched CVE check] * xref:packages/release_cve.adoc#cve__cve_results_found[CVE checks: CVE scan results found] diff --git a/antora/docs/modules/ROOT/partials/release_policy_nav.adoc b/antora/docs/modules/ROOT/partials/release_policy_nav.adoc index abaae103e..28c0b68f0 100644 --- a/antora/docs/modules/ROOT/partials/release_policy_nav.adoc +++ b/antora/docs/modules/ROOT/partials/release_policy_nav.adoc @@ -27,7 +27,6 @@ **** xref:packages/release_buildah_build_task.adoc#buildah_build_task__malformed_parameter[Build task parameters are well-formed] **** xref:packages/release_buildah_build_task.adoc#buildah_build_task__buildah_uses_local_dockerfile[Buildah task uses a local Dockerfile] **** xref:packages/release_buildah_build_task.adoc#buildah_build_task__platform_param[PLATFORM parameter] -**** xref:packages/release_buildah_build_task.adoc#buildah_build_task__privileged_nested_param[PRIVILEGED_NESTED parameter] **** xref:packages/release_buildah_build_task.adoc#buildah_build_task__disallowed_platform_patterns_pattern[disallowed_platform_patterns format] *** xref:packages/release_cve.adoc[CVE checks] **** xref:packages/release_cve.adoc#cve__cve_blockers[Blocking CVE check] diff --git a/policy/release/buildah_build_task/buildah_build_task.rego b/policy/release/buildah_build_task/buildah_build_task.rego index 08ec5c04e..3a6393128 100644 --- a/policy/release/buildah_build_task/buildah_build_task.rego +++ b/policy/release/buildah_build_task/buildah_build_task.rego @@ -99,33 +99,10 @@ deny contains result if { result := metadata.result_helper_with_severity(rego.metadata.chain(), [error.message], error.severity) } -# METADATA -# title: PRIVILEGED_NESTED parameter -# description: >- -# Verify the PRIVILEGED_NESTED parameter of a builder Tasks was not set to `true`. -# custom: -# short_name: privileged_nested_param -# failure_msg: setting PRIVILEGED_NESTED parameter to true is not allowed -# solution: >- -# Setting PRIVILEGED_NESTED parameter to true is not allowed for most container -# image builds. Either set the parameter value to false or use a policy config -# that excludes this policy rule. -# collections: -# - redhat -# - redhat_security -# depends_on: -# - attestation_type.known_attestation_type -# -deny contains result if { - some param in _privileged_nested_params - trim_space(param) == "true" - result := metadata.result_helper(rego.metadata.chain(), []) -} - # METADATA # title: Build task parameters are well-formed # description: >- -# Verify that the DOCKERFILE, ADD_CAPABILITIES, PLATFORM and PRIVILEGED_NESTED +# Verify that the DOCKERFILE, ADD_CAPABILITIES and PLATFORM # parameters of a builder Task, when present, are provided as strings. A # non-string value (null, number, object or array), or a malformed parameter # container that hides the parameters entirely, would otherwise be silently @@ -174,13 +151,8 @@ _platform_params contains param if { param := tekton.task_param(buildah_task, "PLATFORM") } -_privileged_nested_params contains param if { - some buildah_task in _buildah_tasks - param := tekton.task_param(buildah_task, "PRIVILEGED_NESTED") -} - # The build task parameters that must be strings when present. -_string_param_names := {"DOCKERFILE", "ADD_CAPABILITIES", "PLATFORM", "PRIVILEGED_NESTED"} +_string_param_names := {"DOCKERFILE", "ADD_CAPABILITIES", "PLATFORM"} _malformed_params contains name if { some buildah_task in _buildah_tasks diff --git a/policy/release/buildah_build_task/buildah_build_task_test.rego b/policy/release/buildah_build_task/buildah_build_task_test.rego index 80a0e3c5d..040cf2728 100644 --- a/policy/release/buildah_build_task/buildah_build_task_test.rego +++ b/policy/release/buildah_build_task/buildah_build_task_test.rego @@ -377,89 +377,12 @@ test_plat_patterns_anchoring_warning if { assertions.assert_not_empty(buildah_build_task.deny) with data.rule_data as d_ineffective } -test_privileged_nested_param if { - expected := {{ - "code": "buildah_build_task.privileged_nested_param", - "msg": "setting PRIVILEGED_NESTED parameter to true is not allowed", - }} - - _task_base := tekton_test.slsav1_task("buildah") - _task_w_params = tekton_test.with_params( - _task_base, - [ - { - "name": "IMAGE", - "value": "quay.io/jstuart/hacbs-docker-build", - }, - { - "name": "DOCKERFILE", - "value": "./image_with_labels/Dockerfile", - }, - { - "name": "PRIVILEGED_NESTED", - "value": "true", - }, - ], - ) - task = tekton_test.with_results(_task_w_params, _results) - - attestation := tekton_test.slsav1_attestation([task]) - assertions.assert_equal_results(expected, buildah_build_task.deny) with input.attestations as [attestation] - - _task_empty_base := tekton_test.slsav1_task("buildah") - _task_empty_w_params = tekton_test.with_params( - _task_empty_base, - [ - { - "name": "IMAGE", - "value": "quay.io/jstuart/hacbs-docker-build", - }, - { - "name": "DOCKERFILE", - "value": "./image_with_labels/Dockerfile", - }, - { - "name": "PRIVILEGED_NESTED", - "value": "", - }, - ], - ) - task_empty = tekton_test.with_results(_task_empty_w_params, _results) - - attestation_empty := tekton_test.slsav1_attestation([task_empty]) - assertions.assert_empty(buildah_build_task.deny) with input.attestations as [attestation_empty] - - _task_false_base := tekton_test.slsav1_task("buildah") - _task_false_w_params = tekton_test.with_params( - _task_false_base, - [ - { - "name": "IMAGE", - "value": "quay.io/jstuart/hacbs-docker-build", - }, - { - "name": "DOCKERFILE", - "value": "./image_with_labels/Dockerfile", - }, - { - "name": "PRIVILEGED_NESTED", - "value": "false", - }, - ], - ) - task_false = tekton_test.with_results(_task_false_w_params, _results) - - attestation_false := tekton_test.slsav1_attestation([task_false]) - assertions.assert_empty(buildah_build_task.deny) with input.attestations as [attestation_false] -} - # A present but non-string build task parameter must be rejected as malformed # instead of being silently ignored by the string-only checks. test_malformed_parameter if { _malformed_denies("DOCKERFILE", null) _malformed_denies("ADD_CAPABILITIES", 42) _malformed_denies("PLATFORM", ["linux/amd64"]) - _malformed_denies("PRIVILEGED_NESTED", {"nested": true}) } # A malformed parameter container hides every parameter from the string checks, so