From ecac3cc10b89da3afb7265e7bfc929d34f60b9ab Mon Sep 17 00:00:00 2001 From: Chai Bot Date: Thu, 8 Oct 2026 20:43:12 +0000 Subject: [PATCH] Remove PRIVILEGED_NESTED deny rule from buildah_build_task MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The PRIVILEGED_NESTED parameter check is removed entirely rather than downgraded. In-cluster PRIVILEGED_NESTED is effectively privilege- equivalent to the pod itself — any arbitrary Tekton task can already run equivalent code. The parameter is no more dangerous than any arbitrary task, so the policy check adds friction without security value. Removes the deny rule, its _privileged_nested_params helper, the corresponding test, and regenerates documentation. Co-Authored-By: Claude Opus 4.6 --- .../packages/release_buildah_build_task.adoc | 16 +--- .../modules/ROOT/pages/release_policy.adoc | 2 - .../ROOT/partials/release_policy_nav.adoc | 1 - .../buildah_build_task.rego | 32 +------- .../buildah_build_task_test.rego | 77 ------------------- 5 files changed, 4 insertions(+), 124 deletions(-) diff --git a/antora/docs/modules/ROOT/pages/packages/release_buildah_build_task.adoc b/antora/docs/modules/ROOT/pages/packages/release_buildah_build_task.adoc index 1e8862318..a6aa2f5bd 100644 --- a/antora/docs/modules/ROOT/pages/packages/release_buildah_build_task.adoc +++ b/antora/docs/modules/ROOT/pages/packages/release_buildah_build_task.adoc @@ -24,7 +24,7 @@ Verify the ADD_CAPABILITIES parameter of a builder Tasks was not used. [#buildah_build_task__malformed_parameter] === link:#buildah_build_task__malformed_parameter[Build task parameters are well-formed] -Verify that the DOCKERFILE, ADD_CAPABILITIES, PLATFORM and PRIVILEGED_NESTED parameters of a builder Task, when present, are provided as strings. A non-string value (null, number, object or array), or a malformed parameter container that hides the parameters entirely, would otherwise be silently ignored by the parameter checks, allowing a malformed value to look like a pass. +Verify that the DOCKERFILE, ADD_CAPABILITIES and PLATFORM parameters of a builder Task, when present, are provided as strings. A non-string value (null, number, object or array), or a malformed parameter container that hides the parameters entirely, would otherwise be silently ignored by the parameter checks, allowing a malformed value to look like a pass. *Solution*: Provide the parameter as a string value, or unset it if it is optional. @@ -32,7 +32,7 @@ Verify that the DOCKERFILE, ADD_CAPABILITIES, PLATFORM and PRIVILEGED_NESTED par * FAILURE message: `%s` * Code: `buildah_build_task.malformed_parameter` * Effective from: `2027-01-11T00:00:00Z` -* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/buildah_build_task/buildah_build_task.rego#L125[Source, window="_blank"] +* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/buildah_build_task/buildah_build_task.rego#L102[Source, window="_blank"] [#buildah_build_task__buildah_uses_local_dockerfile] === link:#buildah_build_task__buildah_uses_local_dockerfile[Buildah task uses a local Dockerfile] @@ -59,18 +59,6 @@ Verify the value of the PLATFORM parameter of a builder Task is allowed by match * Effective from: `2024-09-01T00:00:00Z` * https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/buildah_build_task/buildah_build_task.rego#L63[Source, window="_blank"] -[#buildah_build_task__privileged_nested_param] -=== link:#buildah_build_task__privileged_nested_param[PRIVILEGED_NESTED parameter] - -Verify the PRIVILEGED_NESTED parameter of a builder Tasks was not set to `true`. - -*Solution*: Setting PRIVILEGED_NESTED parameter to true is not allowed for most container image builds. Either set the parameter value to false or use a policy config that excludes this policy rule. - -* Rule type: [rule-type-indicator failure]#FAILURE# -* FAILURE message: `setting PRIVILEGED_NESTED parameter to true is not allowed` -* Code: `buildah_build_task.privileged_nested_param` -* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/buildah_build_task/buildah_build_task.rego#L102[Source, window="_blank"] - [#buildah_build_task__disallowed_platform_patterns_pattern] === link:#buildah_build_task__disallowed_platform_patterns_pattern[disallowed_platform_patterns format] diff --git a/antora/docs/modules/ROOT/pages/release_policy.adoc b/antora/docs/modules/ROOT/pages/release_policy.adoc index 4c06f19dd..109a44c58 100644 --- a/antora/docs/modules/ROOT/pages/release_policy.adoc +++ b/antora/docs/modules/ROOT/pages/release_policy.adoc @@ -127,7 +127,6 @@ Rules included: * xref:packages/release_buildah_build_task.adoc#buildah_build_task__malformed_parameter[Buildah build task: Build task parameters are well-formed] * xref:packages/release_buildah_build_task.adoc#buildah_build_task__buildah_uses_local_dockerfile[Buildah build task: Buildah task uses a local Dockerfile] * xref:packages/release_buildah_build_task.adoc#buildah_build_task__platform_param[Buildah build task: PLATFORM parameter] -* xref:packages/release_buildah_build_task.adoc#buildah_build_task__privileged_nested_param[Buildah build task: PRIVILEGED_NESTED parameter] * xref:packages/release_buildah_build_task.adoc#buildah_build_task__disallowed_platform_patterns_pattern[Buildah build task: disallowed_platform_patterns format] * xref:packages/release_cve.adoc#cve__cve_blockers[CVE checks: Blocking CVE check] * xref:packages/release_cve.adoc#cve__unpatched_cve_blockers[CVE checks: Blocking unpatched CVE check] @@ -365,7 +364,6 @@ Rules included: * xref:packages/release_buildah_build_task.adoc#buildah_build_task__add_capabilities_param[Buildah build task: ADD_CAPABILITIES parameter] * xref:packages/release_buildah_build_task.adoc#buildah_build_task__malformed_parameter[Buildah build task: Build task parameters are well-formed] * xref:packages/release_buildah_build_task.adoc#buildah_build_task__buildah_uses_local_dockerfile[Buildah build task: Buildah task uses a local Dockerfile] -* xref:packages/release_buildah_build_task.adoc#buildah_build_task__privileged_nested_param[Buildah build task: PRIVILEGED_NESTED parameter] * xref:packages/release_cve.adoc#cve__cve_blockers[CVE checks: Blocking CVE check] * xref:packages/release_cve.adoc#cve__unpatched_cve_blockers[CVE checks: Blocking unpatched CVE check] * xref:packages/release_cve.adoc#cve__cve_results_found[CVE checks: CVE scan results found] diff --git a/antora/docs/modules/ROOT/partials/release_policy_nav.adoc b/antora/docs/modules/ROOT/partials/release_policy_nav.adoc index abaae103e..28c0b68f0 100644 --- a/antora/docs/modules/ROOT/partials/release_policy_nav.adoc +++ b/antora/docs/modules/ROOT/partials/release_policy_nav.adoc @@ -27,7 +27,6 @@ **** xref:packages/release_buildah_build_task.adoc#buildah_build_task__malformed_parameter[Build task parameters are well-formed] **** xref:packages/release_buildah_build_task.adoc#buildah_build_task__buildah_uses_local_dockerfile[Buildah task uses a local Dockerfile] **** xref:packages/release_buildah_build_task.adoc#buildah_build_task__platform_param[PLATFORM parameter] -**** xref:packages/release_buildah_build_task.adoc#buildah_build_task__privileged_nested_param[PRIVILEGED_NESTED parameter] **** xref:packages/release_buildah_build_task.adoc#buildah_build_task__disallowed_platform_patterns_pattern[disallowed_platform_patterns format] *** xref:packages/release_cve.adoc[CVE checks] **** xref:packages/release_cve.adoc#cve__cve_blockers[Blocking CVE check] diff --git a/policy/release/buildah_build_task/buildah_build_task.rego b/policy/release/buildah_build_task/buildah_build_task.rego index 08ec5c04e..3a6393128 100644 --- a/policy/release/buildah_build_task/buildah_build_task.rego +++ b/policy/release/buildah_build_task/buildah_build_task.rego @@ -99,33 +99,10 @@ deny contains result if { result := metadata.result_helper_with_severity(rego.metadata.chain(), [error.message], error.severity) } -# METADATA -# title: PRIVILEGED_NESTED parameter -# description: >- -# Verify the PRIVILEGED_NESTED parameter of a builder Tasks was not set to `true`. -# custom: -# short_name: privileged_nested_param -# failure_msg: setting PRIVILEGED_NESTED parameter to true is not allowed -# solution: >- -# Setting PRIVILEGED_NESTED parameter to true is not allowed for most container -# image builds. Either set the parameter value to false or use a policy config -# that excludes this policy rule. -# collections: -# - redhat -# - redhat_security -# depends_on: -# - attestation_type.known_attestation_type -# -deny contains result if { - some param in _privileged_nested_params - trim_space(param) == "true" - result := metadata.result_helper(rego.metadata.chain(), []) -} - # METADATA # title: Build task parameters are well-formed # description: >- -# Verify that the DOCKERFILE, ADD_CAPABILITIES, PLATFORM and PRIVILEGED_NESTED +# Verify that the DOCKERFILE, ADD_CAPABILITIES and PLATFORM # parameters of a builder Task, when present, are provided as strings. A # non-string value (null, number, object or array), or a malformed parameter # container that hides the parameters entirely, would otherwise be silently @@ -174,13 +151,8 @@ _platform_params contains param if { param := tekton.task_param(buildah_task, "PLATFORM") } -_privileged_nested_params contains param if { - some buildah_task in _buildah_tasks - param := tekton.task_param(buildah_task, "PRIVILEGED_NESTED") -} - # The build task parameters that must be strings when present. -_string_param_names := {"DOCKERFILE", "ADD_CAPABILITIES", "PLATFORM", "PRIVILEGED_NESTED"} +_string_param_names := {"DOCKERFILE", "ADD_CAPABILITIES", "PLATFORM"} _malformed_params contains name if { some buildah_task in _buildah_tasks diff --git a/policy/release/buildah_build_task/buildah_build_task_test.rego b/policy/release/buildah_build_task/buildah_build_task_test.rego index 80a0e3c5d..040cf2728 100644 --- a/policy/release/buildah_build_task/buildah_build_task_test.rego +++ b/policy/release/buildah_build_task/buildah_build_task_test.rego @@ -377,89 +377,12 @@ test_plat_patterns_anchoring_warning if { assertions.assert_not_empty(buildah_build_task.deny) with data.rule_data as d_ineffective } -test_privileged_nested_param if { - expected := {{ - "code": "buildah_build_task.privileged_nested_param", - "msg": "setting PRIVILEGED_NESTED parameter to true is not allowed", - }} - - _task_base := tekton_test.slsav1_task("buildah") - _task_w_params = tekton_test.with_params( - _task_base, - [ - { - "name": "IMAGE", - "value": "quay.io/jstuart/hacbs-docker-build", - }, - { - "name": "DOCKERFILE", - "value": "./image_with_labels/Dockerfile", - }, - { - "name": "PRIVILEGED_NESTED", - "value": "true", - }, - ], - ) - task = tekton_test.with_results(_task_w_params, _results) - - attestation := tekton_test.slsav1_attestation([task]) - assertions.assert_equal_results(expected, buildah_build_task.deny) with input.attestations as [attestation] - - _task_empty_base := tekton_test.slsav1_task("buildah") - _task_empty_w_params = tekton_test.with_params( - _task_empty_base, - [ - { - "name": "IMAGE", - "value": "quay.io/jstuart/hacbs-docker-build", - }, - { - "name": "DOCKERFILE", - "value": "./image_with_labels/Dockerfile", - }, - { - "name": "PRIVILEGED_NESTED", - "value": "", - }, - ], - ) - task_empty = tekton_test.with_results(_task_empty_w_params, _results) - - attestation_empty := tekton_test.slsav1_attestation([task_empty]) - assertions.assert_empty(buildah_build_task.deny) with input.attestations as [attestation_empty] - - _task_false_base := tekton_test.slsav1_task("buildah") - _task_false_w_params = tekton_test.with_params( - _task_false_base, - [ - { - "name": "IMAGE", - "value": "quay.io/jstuart/hacbs-docker-build", - }, - { - "name": "DOCKERFILE", - "value": "./image_with_labels/Dockerfile", - }, - { - "name": "PRIVILEGED_NESTED", - "value": "false", - }, - ], - ) - task_false = tekton_test.with_results(_task_false_w_params, _results) - - attestation_false := tekton_test.slsav1_attestation([task_false]) - assertions.assert_empty(buildah_build_task.deny) with input.attestations as [attestation_false] -} - # A present but non-string build task parameter must be rejected as malformed # instead of being silently ignored by the string-only checks. test_malformed_parameter if { _malformed_denies("DOCKERFILE", null) _malformed_denies("ADD_CAPABILITIES", 42) _malformed_denies("PLATFORM", ["linux/amd64"]) - _malformed_denies("PRIVILEGED_NESTED", {"nested": true}) } # A malformed parameter container hides every parameter from the string checks, so