Extend the apparmor profile template with profile mode flag and adapt…

… the generate profile Change-Id: If59b953c69e48e68b2bb56198567342ca9483170 Signed-off-by: Cosmin Cojocar <[email protected]>
kubernetes-sigs · Dec 4, 2024 · 1d05620 · 1d05620
1 parent 22f7916
commit 1d05620
Show file tree

Hide file tree

Showing 5 changed files with 53 additions and 14 deletions.
diff --git a/internal/pkg/cli/converter/converter.go b/internal/pkg/cli/converter/converter.go
@@ -70,7 +70,7 @@ func (p *Converter) Run() error {
 			programName = obj.Name
 		}
 
-		outStr, err := crd2armor.GenerateProfile(programName, &obj.Spec.Abstract)
+		outStr, err := crd2armor.GenerateProfile(programName, obj.Spec.ComplainMode, &obj.Spec.Abstract)
 		if err != nil {
 			return fmt.Errorf("build raw apparmor profile: %w", err)
 		}

diff --git a/internal/pkg/cli/converter/converter_test.go b/internal/pkg/cli/converter/converter_test.go
@@ -40,10 +40,10 @@ func TestRun(t *testing.T) {
 	for _, tc := range []struct {
 		name           string
 		input          string
-		outputContains string
+		outputContains []string
 	}{
 		{
-			name: "AppArmor CRD",
+			name: "AppArmor CRD in enforce mode by default",
 			input: `
 apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
 kind: AppArmorProfile
@@ -53,7 +53,35 @@ spec:
       readOnlyPaths:
       - /dev/null
 `,
-			outputContains: `deny /dev/null wl`,
+			outputContains: []string{`deny /dev/null wl`, `flags=(enforce,attach_disconnected,mediate_deleted)`},
+		},
+		{
+			name: "AppArmor CRD in enforce mode",
+			input: `
+apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
+kind: AppArmorProfile
+spec:
+  complainMode: false
+  abstract:
+    filesystem:
+      readOnlyPaths:
+      - /dev/null
+`,
+			outputContains: []string{`deny /dev/null wl`, `flags=(enforce,attach_disconnected,mediate_deleted)`},
+		},
+		{
+			name: "AppArmor CRD in complain mode",
+			input: `
+apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
+kind: AppArmorProfile
+spec:
+  complainMode: true
+  abstract:
+    filesystem:
+      readOnlyPaths:
+      - /dev/null
+`,
+			outputContains: []string{`deny /dev/null wl`, `flags=(complain,attach_disconnected,mediate_deleted)`},
 		},
 		{
 			name: "seccomp",
@@ -67,7 +95,7 @@ spec:
     names:
     - foo
 `,
-			outputContains: `"defaultAction": "SCMP_ACT_ERRNO"`,
+			outputContains: []string{`"defaultAction": "SCMP_ACT_ERRNO"`},
 		},
 	} {
 		input := tc.input
@@ -83,7 +111,9 @@ spec:
 			err := sut.Run()
 			require.NoError(t, err)
 			_, actual, _ := mock.WriteFileArgsForCall(0)
-			require.Contains(t, string(actual), outputContains)
+			for _, contain := range outputContains {
+				require.Contains(t, string(actual), contain)
+			}
 		})
 	}
 

diff --git a/internal/pkg/cli/recorder/recorder.go b/internal/pkg/cli/recorder/recorder.go
@@ -432,7 +432,7 @@ func (r *Recorder) buildAppArmorProfileRaw(writer io.Writer, spec *apparmorprofi
 	}
 
 	abstract := spec.Abstract
-	raw, err := crd2armor.GenerateProfile(programName, &abstract)
+	raw, err := crd2armor.GenerateProfile(programName, spec.ComplainMode, &abstract)
 	if err != nil {
 		return fmt.Errorf("build raw apparmor profile: %w", err)
 	}

diff --git a/internal/pkg/daemon/apparmorprofile/apparmor_supported.go b/internal/pkg/daemon/apparmorprofile/apparmor_supported.go
@@ -79,7 +79,7 @@ func (a *aaProfileManager) InstallProfile(bp profilebasev1alpha1.StatusBaseUser)
 		return false, errors.New(errInvalidCustomResourceType)
 	}
 
-	policy, err := crd2armor.GenerateProfile(profile.GetProfileName(), &profile.Spec.Abstract)
+	policy, err := crd2armor.GenerateProfile(profile.GetProfileName(), profile.Spec.ComplainMode, &profile.Spec.Abstract)
 	if err != nil {
 		return false, fmt.Errorf("generating raw apparmor profile: %w", err)
 	}

diff --git a/internal/pkg/daemon/apparmorprofile/crd2armor/crd2armor.go b/internal/pkg/daemon/apparmorprofile/crd2armor/crd2armor.go
@@ -27,7 +27,7 @@ import (
 var appArmorTemplate = `
 # Generated by https://github.com/kubernetes-sigs/security-profiles-operator, do not edit by hand.
 #include <tunables/global>
-profile {{.Name}} flags=(attach_disconnected,mediate_deleted) {
+profile {{.Name}} flags=({{.ProfileMode}},attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
   # Executable rules
@@ -91,18 +91,20 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) {
 `
 
 type apparmorTemplateArgs struct {
-	Name     string
-	Abstract *apparmorprofileapi.AppArmorAbstract
+	Name        string
+	ProfileMode string
+	Abstract    *apparmorprofileapi.AppArmorAbstract
 }
 
 // GenerateProfile uses the CRD representation of an abstracted profile to generate a
 // full AppArmor profile.
-func GenerateProfile(name string, abstract *apparmorprofileapi.AppArmorAbstract) (string, error) {
+func GenerateProfile(name string, complainMode bool, abstract *apparmorprofileapi.AppArmorAbstract) (string, error) {
 	var generated bytes.Buffer
 
 	templateArgs := apparmorTemplateArgs{
-		Name:     name,
-		Abstract: abstract,
+		Name:        name,
+		ProfileMode: profileMode(complainMode),
+		Abstract:    abstract,
 	}
 
 	if abstract == nil {
@@ -118,3 +120,10 @@ func GenerateProfile(name string, abstract *apparmorprofileapi.AppArmorAbstract)
 	}
 	return generated.String(), nil
 }
+
+func profileMode(complainMode bool) string {
+	if complainMode {
+		return "complain"
+	}
+	return "enforce"
+}