kubearmor / policy-templates

Community curated list of System and Network policy templates for the KubeArmor and Cilium

KubeArmor is a cloud-native runtime security enforcement system that restricts the behavior (such as process execution, file access, and networking operations) of pods, containers, and nodes (VMs) at the system level.

KubeArmor leverages Linux security modules (LSMs) such as AppArmor, SELinux, or BPF-LSM to enforce the user-specified policies. KubeArmor generates rich alerts/telemetry events with container/pod/namespace identities by leveraging eBPF.

💪 Harden Infrastructure ⛓️ Protect critical paths such as cert bundles 📋 MITRE, STIGs, CIS based rules 🛅 Restrict access to raw DB table	💍 Least Permissive Access 🚥 Process Whitelisting 🚥 Network Whitelisting 🎛️ Control access to sensitive assets
🔭 Application Behavior 🧬 Process execs, File System accesses 🧭 Service binds, Ingress, Egress connections 🔬 Sensitive system call profiling	❄️ Deployment Models ☸️ Kubernetes Deployment 🐋 Containerized Deployment 💻 VM/Bare-Metal Deployment

Architecture Overview

Documentation 📓

• 👉 Getting Started
• 🎯 Use Cases
• ✔️ KubeArmor Support Matrix
• ♟️ How is KubeArmor different?
• 📜 Security Policy for Pods/Containers [Spec] [Examples]
• 📜 Security Policy for Hosts/Nodes [Spec] [Examples]
  ... detailed documentation

Contributors 👥

• 📘 Contribution Guide
• 🧑‍💻 Development Guide, Testing Guide
• ✋ Join KubeArmor Slack
• ❓ FAQs

Biweekly Meeting

• 🗣️ Zoom Link
• 📄 Minutes: Document
• 📆 Calendar invite: Google Calendar, ICS file

Notice/Credits 🤝

• KubeArmor uses Tracee's system call utility functions.

CNCF

KubeArmor is Sandbox Project of the Cloud Native Computing Foundation.

ROADMAP

KubeArmor roadmap is tracked via KubeArmor Projects

policy-templates's Issues

CIS Hardening Policy to add noexec for /tmp

Ref https://www.tenable.com/audits/items/CIS_Fedora_19_Family_Linux_Server_L1_v1.0.0.audit:cb3137da1a61c8c0f01d86957ea67ada
Please find relevant official source for this CIS rule.

We can secure against this using the following KubeArmor rule.

  process:
    matchDirectories:
    - dir: /tmp/
      recursive: true
      action: Block

package mgmt tools should include apk

On alpine linux, apk is used for package management and should be part of the list.

Please include /sbin/apk in the list.

CC: @vishnusomank @yasin-cs-ko-ak

Please discard: [ksp-redis-hardening-rule-audit-redis-dangerous-command.yaml]

• As KubeArmor currently does not support Reddis
• Policy link - [https://github.com/kubearmor/policy-templates/blob/main/redis/system/ksp-redis-hardening-rule-audit-redis-dangerous-command.yaml]