Skip to content

Commit 3dd6cb7

Browse files
github-actions[bot]github-actions[bot]
authored
Update rule metadata (#1496)
Co-authored-by: mstachniuk <mstachniuk>
1 parent fc7bb11 commit 3dd6cb7

File tree

7 files changed

+85
-17
lines changed

7 files changed

+85
-17
lines changed

‎iac-extensions/arm/sonarpedia.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"languages": [
44
"AZURE_RESOURCE_MANAGER"
55
],
6-
"latest-update": "2024-08-16T07:50:07.534405Z",
6+
"latest-update": "2024-09-02T14:46:42.140530Z",
77
"options": {
88
"no-language-in-filenames": true,
99
"preserve-filenames": true

‎iac-extensions/cloudformation/sonarpedia.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"languages": [
44
"CLOUD_FORMATION"
55
],
6-
"latest-update": "2024-08-16T07:50:15.493939Z",
6+
"latest-update": "2024-09-02T14:46:49.511642Z",
77
"options": {
88
"no-language-in-filenames": true,
99
"preserve-filenames": true

‎iac-extensions/docker/sonarpedia.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"languages": [
44
"DOCKER"
55
],
6-
"latest-update": "2024-08-16T07:50:23.559218Z",
6+
"latest-update": "2024-09-02T14:46:56.877054Z",
77
"options": {
88
"no-language-in-filenames": true,
99
"preserve-filenames": true

‎iac-extensions/kubernetes/sonarpedia.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"languages": [
44
"KUBERNETES"
55
],
6-
"latest-update": "2024-08-16T07:50:30.957934Z",
6+
"latest-update": "2024-09-02T14:47:03.763797Z",
77
"options": {
88
"no-language-in-filenames": true,
99
"preserve-filenames": true

‎iac-extensions/kubernetes/src/main/resources/org/sonar/l10n/kubernetes/rules/kubernetes/S6865.html‎

Lines changed: 78 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,8 @@
11
<h2>Why is this an issue?</h2>
2-
<p>Service account tokens are Kubernetes secrets created automatically to authenticate applications running inside pods to the API server. If a pod is
3-
compromised, an attacker could use this token to gain access to other resources in the cluster.</p>
2+
<p>Service account tokens are Kubernetes secrets to authenticate applications running inside pods to the API server. If a pod is compromised, an
3+
attacker could use this token to gain access to other resources in the cluster.</p>
44
<p>For example, they could create new pods, modify existing ones, or even delete critical system pods, depending on the permissions associated with
55
the service account.</p>
6-
<p>Therefore, it’s recommended to disable the automounting of service account tokens when it’s not necessary for the application running in the
7-
pod.</p>
86
<h3>What is the potential impact?</h3>
97
<h4>Unauthorized Access</h4>
108
<p>If a pod with a mounted service account gets compromised, an attacker could potentially use the token to interact with the Kubernetes API, possibly
@@ -21,15 +19,30 @@ <h4>Denial of Service</h4>
2119
<h2>How to fix it</h2>
2220
<h3>Code examples</h3>
2321
<h4>Noncompliant code example</h4>
22+
<p>In this example, the service account token is mounted in the pod <code>example-pod</code> by default, but is unnecessary for the pod and its
23+
service(s) to function correctly.</p>
2424
<pre data-diff-id="1" data-diff-type="noncompliant">
2525
apiVersion: v1
2626
kind: Pod
2727
metadata:
2828
name: example-pod
2929
spec: # Noncompliant
3030
containers:
31-
- name: example-pod
32-
image: nginx:1.25.3
31+
- name: example-container
32+
image: nginx
33+
</pre>
34+
<p>In this example, the service account token is mounted in the pod <code>example-pod</code> and is necessary, for example because it allows a
35+
third-party service to authenticate with the Kubernetes API. However, no specific permissions are granted to the service account:</p>
36+
<pre data-diff-id="2" data-diff-type="noncompliant">
37+
apiVersion: v1
38+
kind: Pod
39+
metadata:
40+
name: example-pod
41+
spec:
42+
serviceAccountName: example-sa # Noncompliant
43+
containers:
44+
- name: example-container
45+
image: nginx
3346
</pre>
3447
<h4>Compliant solution</h4>
3548
<pre data-diff-id="1" data-diff-type="compliant">
@@ -39,13 +52,68 @@ <h4>Compliant solution</h4>
3952
name: example-pod
4053
spec:
4154
containers:
42-
- name: example-pod
43-
image: nginx:1.25.3
55+
- name: example-container
56+
image: nginx
4457
automountServiceAccountToken: false
4558
</pre>
59+
<p>In the following example, Role bindings are created, but Cluster Role Bindings would be more appropriate if the service account is intended to be
60+
used across multiple namespaces:</p>
61+
<pre data-diff-id="2" data-diff-type="compliant">
62+
---
63+
apiVersion: v1
64+
kind: ServiceAccount
65+
metadata:
66+
name: example-sa
67+
namespace: default
68+
69+
---
70+
apiVersion: rbac.authorization.k8s.io/v1
71+
kind: Role
72+
metadata:
73+
namespace: default
74+
name: example-role
75+
rules:
76+
- apiGroups: [""]
77+
resources: ["pods"]
78+
verbs: ["list"]
79+
80+
---
81+
apiVersion: rbac.authorization.k8s.io/v1
82+
kind: RoleBinding
83+
metadata:
84+
name: example-role-binding
85+
namespace: default
86+
subjects:
87+
- kind: ServiceAccount
88+
name: example-sa
89+
namespace: default
90+
roleRef:
91+
kind: Role
92+
name: example-role
93+
apiGroup: rbac.authorization.k8s.io
94+
95+
---
96+
apiVersion: v1
97+
kind: Pod
98+
metadata:
99+
name: example-pod
100+
namespace: default
101+
spec:
102+
serviceAccountName: example-sa
103+
containers:
104+
- name: example-container
105+
image: nginx
106+
</pre>
46107
<h3>How does this work?</h3>
47-
<p>The automounting of service account tokens can be disabled by setting <code>automountServiceAccountToken: false</code> in the pod’s specification.
48-
Additionally, it can be disabled in the configuration of an accompanied service account.</p>
108+
<p>The essential part of the solution is to make sure that permissions within the cluster are constructed in a way that minimizes the risk of
109+
unauthorized access.</p>
110+
<p>To do so, it follows a least-privilege approach.</p>
111+
<ol>
112+
<li> If the service account token is unnecessary for the pod to function, disable automounting. </li>
113+
<li> If the service account token is required, ensure that the service account has the least amount of permissions necessary to perform its
114+
function. </li>
115+
</ol>
116+
<p>Additionally, service account token automounting can be disabled directly from the service account specification file.</p>
49117
<h2>Resources</h2>
50118
<h3>Documentation</h3>
51119
<ul>

‎iac-extensions/kubernetes/src/main/resources/org/sonar/l10n/kubernetes/rules/kubernetes/S6865.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
{
2-
"title": "Service account tokens should not be mounted in pods",
2+
"title": "Service account permissions should be restricted",
33
"type": "VULNERABILITY",
44
"status": "ready",
55
"remediation": {
66
"func": "Constant\/Issue",
7-
"constantCost": "5min"
7+
"constantCost": "1h"
88
},
99
"tags": [],
1010
"defaultSeverity": "Major",

‎iac-extensions/terraform/sonarpedia.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"languages": [
44
"TERRAFORM"
55
],
6-
"latest-update": "2024-08-16T07:50:39.394004Z",
6+
"latest-update": "2024-09-02T14:47:11.602411Z",
77
"options": {
88
"no-language-in-filenames": true,
99
"preserve-filenames": true

0 commit comments

Comments
 (0)