Skip to content

Commit d935b12

Browse files
php-coderphp-coder
committed
admission_test.go(TestAdmit): split to TestAdmitSuccess and TestAdmitFailure.
1 parent c634e11 commit d935b12

File tree

1 file changed

+184
-120
lines changed

1 file changed

+184
-120
lines changed

‎pkg/security/admission/admission_test.go

+184-120
Original file line numberDiff line numberDiff line change
@@ -179,7 +179,7 @@ func testSCCAdmit(testCaseName string, sccs []*securityapi.SecurityContextConstr
179179
}
180180
}
181181

182-
func TestAdmit(t *testing.T) {
182+
func TestAdmitSuccess(t *testing.T) {
183183
// create the annotated namespace and add it to the fake client
184184
namespace := admissiontesting.CreateNamespaceForTest()
185185
serviceAccount := admissiontesting.CreateSAForTest()
@@ -251,20 +251,6 @@ func TestAdmit(t *testing.T) {
251251
// create the admission plugin
252252
p := NewTestAdmission(cache, tc)
253253

254-
// setup test data
255-
uidNotInRange := goodPod()
256-
var uid int64 = 1001
257-
uidNotInRange.Spec.Containers[0].SecurityContext.RunAsUser = &uid
258-
259-
invalidMCSLabels := goodPod()
260-
invalidMCSLabels.Spec.Containers[0].SecurityContext.SELinuxOptions = &kapi.SELinuxOptions{
261-
Level: "s1:q0,q1",
262-
}
263-
264-
disallowedPriv := goodPod()
265-
var priv bool = true
266-
disallowedPriv.Spec.Containers[0].SecurityContext.Privileged = &priv
267-
268254
// specifies a UID in the range of the preallocated UID annotation
269255
specifyUIDInRange := goodPod()
270256
var goodUID int64 = 3
@@ -293,174 +279,254 @@ func TestAdmit(t *testing.T) {
293279
Level: "s0:c1,c0",
294280
}
295281

296-
requestsHostNetwork := goodPod()
297-
requestsHostNetwork.Spec.SecurityContext.HostNetwork = true
298-
299-
requestsHostPID := goodPod()
300-
requestsHostPID.Spec.SecurityContext.HostPID = true
301-
302-
requestsHostIPC := goodPod()
303-
requestsHostIPC.Spec.SecurityContext.HostIPC = true
304-
305-
requestsHostPorts := goodPod()
306-
requestsHostPorts.Spec.Containers[0].Ports = []kapi.ContainerPort{{HostPort: 1}}
307-
308-
requestsSupplementalGroup := goodPod()
309-
requestsSupplementalGroup.Spec.SecurityContext.SupplementalGroups = []int64{1}
310-
311-
requestsFSGroup := goodPod()
312-
fsGroup := int64(1)
313-
requestsFSGroup.Spec.SecurityContext.FSGroup = &fsGroup
314-
315-
requestsPodLevelMCS := goodPod()
316-
requestsPodLevelMCS.Spec.SecurityContext.SELinuxOptions = &kapi.SELinuxOptions{
317-
User: "user",
318-
Type: "type",
319-
Role: "role",
320-
Level: "level",
321-
}
322-
323282
testCases := map[string]struct {
324283
pod *kapi.Pod
325-
shouldAdmit bool
326284
expectedUID int64
327285
expectedLevel string
328286
expectedFSGroup int64
329287
expectedSupGroups []int64
330288
expectedPriv bool
331289
}{
332-
"uidNotInRange": {
333-
pod: uidNotInRange,
334-
shouldAdmit: false,
335-
},
336-
"invalidMCSLabels": {
337-
pod: invalidMCSLabels,
338-
shouldAdmit: false,
339-
},
340-
"disallowedPriv": {
341-
pod: disallowedPriv,
342-
shouldAdmit: false,
343-
},
344290
"specifyUIDInRange": {
345291
pod: specifyUIDInRange,
346-
shouldAdmit: true,
347292
expectedUID: *specifyUIDInRange.Spec.Containers[0].SecurityContext.RunAsUser,
348293
expectedLevel: "s0:c1,c0",
349294
expectedFSGroup: defaultGroup,
350295
expectedSupGroups: []int64{defaultGroup},
351296
},
352297
"specifyLabels": {
353298
pod: specifyLabels,
354-
shouldAdmit: true,
355299
expectedUID: 1,
356300
expectedLevel: specifyLabels.Spec.Containers[0].SecurityContext.SELinuxOptions.Level,
357301
expectedFSGroup: defaultGroup,
358302
expectedSupGroups: []int64{defaultGroup},
359303
},
360304
"specifyFSGroup": {
361305
pod: specifyFSGroupInRange,
362-
shouldAdmit: true,
363306
expectedUID: 1,
364307
expectedLevel: "s0:c1,c0",
365308
expectedFSGroup: *specifyFSGroupInRange.Spec.SecurityContext.FSGroup,
366309
expectedSupGroups: []int64{defaultGroup},
367310
},
368311
"specifySupGroup": {
369312
pod: specifySupGroup,
370-
shouldAdmit: true,
371313
expectedUID: 1,
372314
expectedLevel: "s0:c1,c0",
373315
expectedFSGroup: defaultGroup,
374316
expectedSupGroups: []int64{specifySupGroup.Spec.SecurityContext.SupplementalGroups[0]},
375317
},
376318
"specifyPodLevelSELinuxLevel": {
377319
pod: specifyPodLevelSELinux,
378-
shouldAdmit: true,
379320
expectedUID: 1,
380321
expectedLevel: "s0:c1,c0",
381322
expectedFSGroup: defaultGroup,
382323
expectedSupGroups: []int64{defaultGroup},
383324
},
325+
}
326+
327+
for i := 0; i < 2; i++ {
328+
for k, v := range testCases {
329+
v.pod.Spec.Containers, v.pod.Spec.InitContainers = v.pod.Spec.InitContainers, v.pod.Spec.Containers
330+
containers := v.pod.Spec.Containers
331+
if i == 0 {
332+
containers = v.pod.Spec.InitContainers
333+
}
334+
attrs := kadmission.NewAttributesRecord(v.pod, nil, kapi.Kind("Pod").WithVersion("version"), v.pod.Namespace, v.pod.Name, kapi.Resource("pods").WithVersion("version"), "", kadmission.Create, &user.DefaultInfo{})
335+
err := p.Admit(attrs)
336+
337+
if err != nil {
338+
t.Fatalf("%s expected no errors but received %v", k, err)
339+
}
340+
341+
validatedSCC, ok := v.pod.Annotations[allocator.ValidatedSCCAnnotation]
342+
if !ok {
343+
t.Errorf("%s expected to find the validated annotation on the pod for the scc but found none", k)
344+
}
345+
if validatedSCC != saSCC.Name {
346+
t.Errorf("%s should have validated against %s but found %s", k, saSCC.Name, validatedSCC)
347+
}
348+
349+
// ensure anything we expected to be defaulted on the container level is set
350+
if *containers[0].SecurityContext.RunAsUser != v.expectedUID {
351+
t.Errorf("%s expected UID %d but found %d", k, v.expectedUID, *containers[0].SecurityContext.RunAsUser)
352+
}
353+
if containers[0].SecurityContext.SELinuxOptions.Level != v.expectedLevel {
354+
t.Errorf("%s expected Level %s but found %s", k, v.expectedLevel, containers[0].SecurityContext.SELinuxOptions.Level)
355+
}
356+
357+
// ensure anything we expected to be defaulted on the pod level is set
358+
if v.pod.Spec.SecurityContext.SELinuxOptions.Level != v.expectedLevel {
359+
t.Errorf("%s expected pod level SELinux Level %s but found %s", k, v.expectedLevel, v.pod.Spec.SecurityContext.SELinuxOptions.Level)
360+
}
361+
if *v.pod.Spec.SecurityContext.FSGroup != v.expectedFSGroup {
362+
t.Errorf("%s expected fsgroup %d but found %d", k, v.expectedFSGroup, *v.pod.Spec.SecurityContext.FSGroup)
363+
}
364+
if len(v.pod.Spec.SecurityContext.SupplementalGroups) != len(v.expectedSupGroups) {
365+
t.Errorf("%s found unexpected supplemental groups. Expected: %v, actual %v", k, v.expectedSupGroups, v.pod.Spec.SecurityContext.SupplementalGroups)
366+
}
367+
for _, g := range v.expectedSupGroups {
368+
if !hasSupGroup(g, v.pod.Spec.SecurityContext.SupplementalGroups) {
369+
t.Errorf("%s expected sup group %d", k, g)
370+
}
371+
}
372+
}
373+
}
374+
}
375+
376+
func TestAdmitFailure(t *testing.T) {
377+
// create the annotated namespace and add it to the fake client
378+
namespace := admissiontesting.CreateNamespaceForTest()
379+
serviceAccount := admissiontesting.CreateSAForTest()
380+
381+
tc := clientsetfake.NewSimpleClientset(namespace, serviceAccount)
382+
383+
// create scc that requires allocation retrieval
384+
saSCC := &securityapi.SecurityContextConstraints{
385+
ObjectMeta: metav1.ObjectMeta{
386+
Name: "scc-sa",
387+
},
388+
RunAsUser: securityapi.RunAsUserStrategyOptions{
389+
Type: securityapi.RunAsUserStrategyMustRunAsRange,
390+
},
391+
SELinuxContext: securityapi.SELinuxContextStrategyOptions{
392+
Type: securityapi.SELinuxStrategyMustRunAs,
393+
},
394+
FSGroup: securityapi.FSGroupStrategyOptions{
395+
Type: securityapi.FSGroupStrategyMustRunAs,
396+
},
397+
SupplementalGroups: securityapi.SupplementalGroupsStrategyOptions{
398+
Type: securityapi.SupplementalGroupsStrategyMustRunAs,
399+
},
400+
Groups: []string{"system:serviceaccounts"},
401+
}
402+
// create scc that has specific requirements that shouldn't match but is permissioned to
403+
// service accounts to test that even though this has matching priorities (0) and a
404+
// lower point value score (which will cause it to be sorted in front of scc-sa) it should not
405+
// validate the requests so we should try scc-sa.
406+
var exactUID int64 = 999
407+
saExactSCC := &securityapi.SecurityContextConstraints{
408+
ObjectMeta: metav1.ObjectMeta{
409+
Name: "scc-sa-exact",
410+
},
411+
RunAsUser: securityapi.RunAsUserStrategyOptions{
412+
Type: securityapi.RunAsUserStrategyMustRunAs,
413+
UID: &exactUID,
414+
},
415+
SELinuxContext: securityapi.SELinuxContextStrategyOptions{
416+
Type: securityapi.SELinuxStrategyMustRunAs,
417+
SELinuxOptions: &kapi.SELinuxOptions{
418+
Level: "s9:z0,z1",
419+
},
420+
},
421+
FSGroup: securityapi.FSGroupStrategyOptions{
422+
Type: securityapi.FSGroupStrategyMustRunAs,
423+
Ranges: []securityapi.IDRange{
424+
{Min: 999, Max: 999},
425+
},
426+
},
427+
SupplementalGroups: securityapi.SupplementalGroupsStrategyOptions{
428+
Type: securityapi.SupplementalGroupsStrategyMustRunAs,
429+
Ranges: []securityapi.IDRange{
430+
{Min: 999, Max: 999},
431+
},
432+
},
433+
Groups: []string{"system:serviceaccounts"},
434+
}
435+
436+
indexer := cache.NewIndexer(cache.MetaNamespaceKeyFunc, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc})
437+
cache := securitylisters.NewSecurityContextConstraintsLister(indexer)
438+
439+
indexer.Add(saExactSCC)
440+
indexer.Add(saSCC)
441+
442+
// create the admission plugin
443+
p := NewTestAdmission(cache, tc)
444+
445+
// setup test data
446+
uidNotInRange := goodPod()
447+
var uid int64 = 1001
448+
uidNotInRange.Spec.Containers[0].SecurityContext.RunAsUser = &uid
449+
450+
invalidMCSLabels := goodPod()
451+
invalidMCSLabels.Spec.Containers[0].SecurityContext.SELinuxOptions = &kapi.SELinuxOptions{
452+
Level: "s1:q0,q1",
453+
}
454+
455+
disallowedPriv := goodPod()
456+
var priv bool = true
457+
disallowedPriv.Spec.Containers[0].SecurityContext.Privileged = &priv
458+
459+
requestsHostNetwork := goodPod()
460+
requestsHostNetwork.Spec.SecurityContext.HostNetwork = true
461+
462+
requestsHostPorts := goodPod()
463+
requestsHostPorts.Spec.Containers[0].Ports = []kapi.ContainerPort{{HostPort: 1}}
464+
465+
requestsHostPID := goodPod()
466+
requestsHostPID.Spec.SecurityContext.HostPID = true
467+
468+
requestsHostIPC := goodPod()
469+
requestsHostIPC.Spec.SecurityContext.HostIPC = true
470+
471+
requestsSupplementalGroup := goodPod()
472+
requestsSupplementalGroup.Spec.SecurityContext.SupplementalGroups = []int64{1}
473+
474+
requestsFSGroup := goodPod()
475+
fsGroup := int64(1)
476+
requestsFSGroup.Spec.SecurityContext.FSGroup = &fsGroup
477+
478+
requestsPodLevelMCS := goodPod()
479+
requestsPodLevelMCS.Spec.SecurityContext.SELinuxOptions = &kapi.SELinuxOptions{
480+
User: "user",
481+
Type: "type",
482+
Role: "role",
483+
Level: "level",
484+
}
485+
486+
testCases := map[string]struct {
487+
pod *kapi.Pod
488+
}{
489+
"uidNotInRange": {
490+
pod: uidNotInRange,
491+
},
492+
"invalidMCSLabels": {
493+
pod: invalidMCSLabels,
494+
},
495+
"disallowedPriv": {
496+
pod: disallowedPriv,
497+
},
384498
"requestsHostNetwork": {
385-
pod: requestsHostNetwork,
386-
shouldAdmit: false,
499+
pod: requestsHostNetwork,
387500
},
388501
"requestsHostPorts": {
389-
pod: requestsHostPorts,
390-
shouldAdmit: false,
502+
pod: requestsHostPorts,
391503
},
392504
"requestsHostPID": {
393-
pod: requestsHostPID,
394-
shouldAdmit: false,
505+
pod: requestsHostPID,
395506
},
396507
"requestsHostIPC": {
397-
pod: requestsHostIPC,
398-
shouldAdmit: false,
508+
pod: requestsHostIPC,
399509
},
400510
"requestsSupplementalGroup": {
401-
pod: requestsSupplementalGroup,
402-
shouldAdmit: false,
511+
pod: requestsSupplementalGroup,
403512
},
404513
"requestsFSGroup": {
405-
pod: requestsFSGroup,
406-
shouldAdmit: false,
514+
pod: requestsFSGroup,
407515
},
408516
"requestsPodLevelMCS": {
409-
pod: requestsPodLevelMCS,
410-
shouldAdmit: false,
517+
pod: requestsPodLevelMCS,
411518
},
412519
}
413520

414521
for i := 0; i < 2; i++ {
415522
for k, v := range testCases {
416523
v.pod.Spec.Containers, v.pod.Spec.InitContainers = v.pod.Spec.InitContainers, v.pod.Spec.Containers
417-
containers := v.pod.Spec.Containers
418-
if i == 0 {
419-
containers = v.pod.Spec.InitContainers
420-
}
421524
attrs := kadmission.NewAttributesRecord(v.pod, nil, kapi.Kind("Pod").WithVersion("version"), v.pod.Namespace, v.pod.Name, kapi.Resource("pods").WithVersion("version"), "", kadmission.Create, &user.DefaultInfo{})
422525
err := p.Admit(attrs)
423526

424-
if v.shouldAdmit && err != nil {
425-
t.Fatalf("%s expected no errors but received %v", k, err)
426-
}
427-
if !v.shouldAdmit && err == nil {
527+
if err == nil {
428528
t.Errorf("%s expected errors but received none", k)
429529
}
430-
431-
if v.shouldAdmit {
432-
validatedSCC, ok := v.pod.Annotations[allocator.ValidatedSCCAnnotation]
433-
if !ok {
434-
t.Errorf("%s expected to find the validated annotation on the pod for the scc but found none", k)
435-
}
436-
if validatedSCC != saSCC.Name {
437-
t.Errorf("%s should have validated against %s but found %s", k, saSCC.Name, validatedSCC)
438-
}
439-
440-
// ensure anything we expected to be defaulted on the container level is set
441-
if *containers[0].SecurityContext.RunAsUser != v.expectedUID {
442-
t.Errorf("%s expected UID %d but found %d", k, v.expectedUID, *containers[0].SecurityContext.RunAsUser)
443-
}
444-
if containers[0].SecurityContext.SELinuxOptions.Level != v.expectedLevel {
445-
t.Errorf("%s expected Level %s but found %s", k, v.expectedLevel, containers[0].SecurityContext.SELinuxOptions.Level)
446-
}
447-
448-
// ensure anything we expected to be defaulted on the pod level is set
449-
if v.pod.Spec.SecurityContext.SELinuxOptions.Level != v.expectedLevel {
450-
t.Errorf("%s expected pod level SELinux Level %s but found %s", k, v.expectedLevel, v.pod.Spec.SecurityContext.SELinuxOptions.Level)
451-
}
452-
if *v.pod.Spec.SecurityContext.FSGroup != v.expectedFSGroup {
453-
t.Errorf("%s expected fsgroup %d but found %d", k, v.expectedFSGroup, *v.pod.Spec.SecurityContext.FSGroup)
454-
}
455-
if len(v.pod.Spec.SecurityContext.SupplementalGroups) != len(v.expectedSupGroups) {
456-
t.Errorf("%s found unexpected supplemental groups. Expected: %v, actual %v", k, v.expectedSupGroups, v.pod.Spec.SecurityContext.SupplementalGroups)
457-
}
458-
for _, g := range v.expectedSupGroups {
459-
if !hasSupGroup(g, v.pod.Spec.SecurityContext.SupplementalGroups) {
460-
t.Errorf("%s expected sup group %d", k, g)
461-
}
462-
}
463-
}
464530
}
465531
}
466532

@@ -496,10 +562,8 @@ func TestAdmit(t *testing.T) {
496562
for k, v := range testCases {
497563
v.pod.Spec.Containers, v.pod.Spec.InitContainers = v.pod.Spec.InitContainers, v.pod.Spec.Containers
498564

499-
if !v.shouldAdmit {
500-
// pods that were rejected by strict SCC, should pass with relaxed SCC
501-
testSCCAdmission(v.pod, p, adminSCC.Name, k, t)
502-
}
565+
// pods that were rejected by strict SCC, should pass with relaxed SCC
566+
testSCCAdmission(v.pod, p, adminSCC.Name, k, t)
503567
}
504568
}
505569
}

0 commit comments

Comments
 (0)