Add MiqAction to annotate container images as non secure at openshift #7536

moolitayer · 2016-03-27T16:23:16Z

Based on:

The metadata created by the MiqAction is meant to be used by Openshift to prevent tagged images from running.

moolitayer · 2016-03-27T16:25:06Z

@miq-bot add_label wip, providers/containers, control

moolitayer · 2016-03-27T16:33:46Z

app/models/container_image.rb

@@ -59,5 +59,9 @@ def perform_metadata_scan(ost)
    scan_via_miq_vm(miq_cnt_group, ost)
  end

+  def prevent_from_starting
+    ext_management_system.annotate(self, {"manageiq.org/security" => "fail"}) # TODO: handle non openshift providers


@smarterclayton @deads2k This is the patch the annotates non secure images.

Which label should we set here?

Any other actions needed to prevent containers based on the image from starting on a master openshift deployed using openshift-ansible (I would like to test)

cc @simon3z

smarterclayton · 2016-03-28T02:36:47Z

We probably need to sort out whether others would set this annotation (a
blackduck scanner, for example), and what policy levels there are.

There are descriptive annotations "this is true for this object" (such as "
security.manageiq.org/image-has-vulnerability" = "true" and "
security.manageiq.org/detected-vulnerabilities"="[...]"), and then there
are affirmative statements ("images.openshift.io/deny-execution" =
"true"). I suspect we need both.

What information do you have at this current time around the image and its
vulnerability stance? Do we have a clear "warn / block" separation based
on vulnerability level?

On Sun, Mar 27, 2016 at 1:02 PM, ManageIQ Bot [email protected]
wrote:

Checked commit moolitayer/manageiq@f607ddf
moolitayer@f607ddf
with ruby 2.2.3, rubocop 0.37.2, and haml-lint 0.16.1
3 files checked, 1 offense detected

app/models/miq_action.rb

[image: 🔹] - Line 832
https://github.com/moolitayer/manageiq/blob/f607ddfaccfca8fc11f1d56030870fc47110fd26/app/models/miq_action.rb#L832,
Col 3 - Metrics/AbcSize
http://rubydoc.info/gems/rubocop/0.37.2/RuboCop/Cop/Metrics/AbcSize

Assignment Branch Condition size for action_container_image_prevent is
too high. [18.11/15]

—
You are receiving this because you were mentioned.
Reply to this email directly or view it on GitHub
#7536 (comment)

deads2k · 2016-03-28T12:23:50Z

I suspect we need both.

I agree. I'd like to have a human-readable string annotation for us to display along with the denial. I suspect that the marking process will have better information than we'll have.

moolitayer · 2016-03-28T13:06:27Z

What information do you have at this current time around the image and its
vulnerability stance? Do we have a clear "warn / block" separation based
on vulnerability level?

This action is ad hock and can be executed in response to which ever condition/s the user chooses. Said condition might be OpenSCAP vulnerabilities detected OR it might be something entirely different e.g image name is X. I think the best we can do here is to name the failed ManageIQ policy, So:

"security.manageiq.org/failed-policies" = []
"security.manageiq.org/failed-policy-ids" = []
And as suggested
"images.openshift.io/deny-execution" = "true"

The deny-execution satisfy my immediate goal. Going forward I'm pretty sure I could define a parameterized action that will allow the user to select his annotations (and examples for those could be provided out of the box)

miq-bot · 2016-04-07T15:57:59Z

<pr_mergeability_checker />This pull request is not mergeable. Please rebase and repush.

moolitayer · 2016-04-20T15:25:36Z

@smarterclayton @deads2k Please review used annotations
@jrafanie Could you please review policy parts
fyi @simon3z

smarterclayton · 2016-04-20T17:44:55Z

app/models/container_image.rb

+      "image",
+      self,
+      "security.manageiq.org/failed-policy" => causing_policy,
+      "images.openshift.io/deny-execution"  => "true"


This looks fine to me.

simon3z · 2016-04-29T13:55:43Z

@miq-bot add_label darga/yes

moolitayer · 2016-05-05T08:27:40Z

@simon3z I should have discovered this sooner but I don't think I can tag with our current inventory.

These are the openshift names I need to know in order to tag:

[root@oshift01 ~]# oc get images 
NAME                                                                      DOCKER REF
sha256:20098eb056620c0ceade04b4bec642fb89c8f3361e89e6ff4729b273f2c799ed   openshift/ruby-20-centos7@sha256:20098eb056620c0ceade04b4bec642fb89c8f3361e89e6ff4729b273f2c799ed
sha256:592872229633f5b906301b1880aeb45272ef83a838794a9c2e53ce07b2a5f3f0   172.30.107.74:5000/test/origin-ruby-sample@sha256:592872229633f5b906301b1880aeb45272ef83a838794a9c2e53ce07b2a5f3f0
sha256:78380eec5f83213b7ef0c0d37a5f285ebb7632ca2c7390b9bd6c07625019cf7e   172.30.107.74:5000/test/origin-ruby-sample@sha256:78380eec5f83213b7ef0c0d37a5f285ebb7632ca2c7390b9bd6c07625019cf7e
sha256:af4c1abc8797bc2df3bfdc92b3ae5fd01984fd4590ffd4899520777f9de2d674   172.30.107.74:5000/test/origin-ruby-sample@sha256:af4c1abc8797bc2df3bfdc92b3ae5fd01984fd4590ffd4899520777f9de2d674
sha256:f334f35cdafe80368b83b53144e2f9a028b2f1170b25f612ce2ad7de890abcba   centos/ruby-22-centos7@sha256:f334f35cdafe80368b83b53144e2f9a028b2f1170b25f612ce2ad7de890abcba

This is the information we look at to create our ManageIQ image inventory:

[root@oshift01 ~]# oc describe pod docker-registry-1-a8bhm|grep -i image
Image(s):           openshift/origin-docker-registry:v1.0.8
    Image:      openshift/origin-docker-registry:v1.0.8
    Image ID:       docker://3629a651e6c11d7435937bdf41da11cf87863c03f2587fa788cf5cbfe8a11b9a

fyi @zeari thoughts?

simon3z · 2016-05-05T08:34:26Z

@simon3z I should have discovered this sooner but I don't think I can tag with our current inventory.

Indeed.

Can't you lookup by "DOCKER REF" or "Image ID"? (cc @deads2k )
If not you have to load them all and find the image yourself (really expensive).

moolitayer · 2016-05-05T11:54:32Z

@simon3z I was wrong, we have digest since #4234 which is what I need. Seems to be missing most of the time (even after taking into account that most ContainerImages do not link to a Openshift image)

moolitayer · 2016-05-05T12:17:16Z

Added handling for images with no digest and usual testing for entity type.

Tested:

ContainerImage.find(8).prevent_from_starting("has openscap failures")

Annotations returned by Openshift:

"annotations": {
"images.openshift.io/deny-execution": "true",
"openshift.io/image.managed": "true",
"security.manageiq.org/failed-policy": "has openscap failures"
}

Another common use case would lead to a guid name (policies can have a descriptive name or a guid name)
... "security.manageiq.org/failed-policy": "2c11dc5a-c080-483e-9ee0-c9ebf6921371"
}

@simon3z Please review

moolitayer · 2016-05-06T07:31:27Z

ping @simon3z

simon3z · 2016-05-06T13:22:31Z

app/models/miq_action.rb

+      return
+    end
+
+    if inputs[:synchronous]


@moolitayer @Fryguy @gmcculloug @blomquisg can anyone (after this patch) take the refactoring of the repeating:

if inputs[:synchronous] log_do_something do_something else log_queuing_do_something queue(do_something) end

It seems pretty common in this module.

Sure I'll give it a try @simon3z

simon3z · 2016-05-06T13:27:54Z

@moolitayer: few minor naming changes.

moolitayer · 2016-05-06T17:21:30Z

app/models/miq_action.rb

+    end
+
+    if inputs[:synchronous]
+      MiqPolicy.logger.info("MIQ(#{__method__}): Now executing  [#{action.description}] for event "\


@gmcculloug Noticed it's Now executing or Queueing in most calls

jrafanie · 2016-05-06T19:05:18Z

Looks good @moolitayer. I had minor comments. Once they're fixed and @simon3z gives the 👍 , I'm good with this.

Note, I don't think we have an out of box deny/stop a vm thing but it seems like they'd have similar mechanics.

moolitayer · 2016-05-06T19:25:24Z

Address comment

moolitayer · 2016-05-06T19:26:05Z

@simon3z please reivew

blomquisg · 2016-05-09T12:39:56Z

app/models/miq_action.rb

+      return
+    end
+
+    unless rec.try(:ext_management_system).kind_of?(ManageIQ::Providers::Openshift::ContainerManagerMixin)


Looks like something that should be refactored in the future. We need to be able to define actions and action handler methods for each manager type and provider.

/cc @durandom

simon3z · 2016-05-09T13:25:39Z

LGTM 👍 cc @blomquisg @jrafanie @chessbyte

blomquisg · 2016-05-09T13:38:02Z

app/models/container_image.rb

@@ -82,5 +82,14 @@ def has_compliance_policies?
    !plist.blank?
  end

+  def annotate_deny_execution(causing_policy)


Based on this error message, this call is only available for OpenShift images. This should really be implemented on an OpenShift implementation of ContainerImage.

But, since ContainerImage does not yet support STI, add an error handler here in case someone calls this method directly. Stopping calls via MiqAction seems insufficient to protect this method.

But, since ContainerImage does not yet support STI, add an error handler here in case someone calls this method directly. Stopping calls via MiqAction seems insufficient to protect this method.

@moolitayer can you take care of that? Thanks.

miq-bot · 2016-05-09T15:19:11Z

Checked commit moolitayer@97d50db with ruby 2.2.3, rubocop 0.37.2, and haml-lint 0.16.1
3 files checked, 2 offenses detected

app/models/miq_action.rb

🔹 - Line 851, Col 3 - Metrics/AbcSize - Assignment Branch Condition size for action_container_image_annotate_deny_execution is too high. [37.23/15]
🔹 - Line 851, Col 3 - Metrics/MethodLength - Method has too many lines. [30/25]

Add MiqAction to annotate container images as non secure at openshift (cherry picked from commit 3b300aa)

moolitayer changed the title ~~New action: tag container images as non secure at openshift~~ [wip]New action: tag container images as non secure at openshift Mar 27, 2016

miq-bot added wip providers/containers core/policy labels Mar 27, 2016

moolitayer reviewed Mar 27, 2016
View reviewed changes

moolitayer force-pushed the annotate_image_action branch from 608cabc to f607ddf Compare March 27, 2016 16:58

moolitayer changed the title ~~[wip]New action: tag container images as non secure at openshift~~ [WIP]New action: tag container images as non secure at openshift Mar 28, 2016

moolitayer changed the title ~~[WIP]New action: tag container images as non secure at openshift~~ [WIP] New action: tag container images as non secure at openshift Mar 29, 2016

moolitayer mentioned this pull request Apr 4, 2016

Containers OpenSCAP #7690

Closed

moolitayer mentioned this pull request Apr 11, 2016

add system:image-auditor openshift/origin#8455

Merged

moolitayer force-pushed the annotate_image_action branch from f607ddf to b9eac70 Compare April 20, 2016 15:21

moolitayer changed the title ~~[WIP] New action: tag container images as non secure at openshift~~ New action: tag container images as non secure at openshift Apr 20, 2016

moolitayer force-pushed the annotate_image_action branch from b9eac70 to 3839459 Compare April 20, 2016 15:29

smarterclayton reviewed Apr 20, 2016
View reviewed changes

chessbyte added enhancement and removed wip labels Apr 21, 2016

miq-bot added the darga/yes label Apr 29, 2016

moolitayer force-pushed the annotate_image_action branch from 3839459 to 6669cad Compare May 5, 2016 12:14

moolitayer changed the title ~~New action: tag container images as non secure at openshift~~ Add MiqAction to annotate container images as non secure at openshift May 5, 2016

simon3z reviewed May 6, 2016
View reviewed changes

moolitayer force-pushed the annotate_image_action branch 2 times, most recently from ae4c0ec to 21ee2a0 Compare May 6, 2016 17:19

moolitayer reviewed May 6, 2016
View reviewed changes

moolitayer force-pushed the annotate_image_action branch from 21ee2a0 to 8c69985 Compare May 6, 2016 19:24

blomquisg reviewed May 9, 2016
View reviewed changes

New action: tag container images as non secure at openshift

97d50db

moolitayer force-pushed the annotate_image_action branch from 8c69985 to 97d50db Compare May 9, 2016 14:24

chessbyte closed this May 9, 2016

chessbyte reopened this May 9, 2016

moolitayer closed this May 9, 2016

moolitayer reopened this May 9, 2016

chessbyte merged commit 3b300aa into ManageIQ:master May 9, 2016

chessbyte added this to the Sprint 40 Ending May 9, 2016 milestone May 9, 2016

chessbyte added a commit that referenced this pull request May 9, 2016

Merge pull request #7536 from moolitayer/annotate_image_action

d84ff8d

Add MiqAction to annotate container images as non secure at openshift (cherry picked from commit 3b300aa)

chessbyte added darga/backported and removed darga/yes labels May 9, 2016

This was referenced May 15, 2016

Extract method invoke_or_queue #8516

Merged

Enhance OpenSCAP miq policy seed #8713

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add MiqAction to annotate container images as non secure at openshift #7536

Add MiqAction to annotate container images as non secure at openshift #7536

moolitayer commented Mar 27, 2016 •

edited

Loading

moolitayer commented Mar 27, 2016

moolitayer Mar 27, 2016

smarterclayton commented Mar 28, 2016

deads2k commented Mar 28, 2016

moolitayer commented Mar 28, 2016

miq-bot commented Apr 7, 2016

moolitayer commented Apr 20, 2016 •

edited

Loading

smarterclayton Apr 20, 2016

simon3z commented Apr 29, 2016

moolitayer commented May 5, 2016 •

edited

Loading

simon3z commented May 5, 2016

moolitayer commented May 5, 2016 •

edited

Loading

moolitayer commented May 5, 2016

moolitayer commented May 6, 2016

simon3z May 6, 2016

moolitayer May 6, 2016

moolitayer May 6, 2016

simon3z commented May 6, 2016

moolitayer May 6, 2016

jrafanie commented May 6, 2016

moolitayer commented May 6, 2016

moolitayer commented May 6, 2016

blomquisg May 9, 2016

simon3z commented May 9, 2016

blomquisg May 9, 2016 •

edited

Loading

simon3z May 9, 2016

moolitayer May 9, 2016

miq-bot commented May 9, 2016

Add MiqAction to annotate container images as non secure at openshift #7536

Add MiqAction to annotate container images as non secure at openshift #7536

Conversation

moolitayer commented Mar 27, 2016 • edited Loading

moolitayer commented Mar 27, 2016

Choose a reason for hiding this comment

smarterclayton commented Mar 28, 2016

deads2k commented Mar 28, 2016

moolitayer commented Mar 28, 2016

miq-bot commented Apr 7, 2016

moolitayer commented Apr 20, 2016 • edited Loading

Choose a reason for hiding this comment

simon3z commented Apr 29, 2016

moolitayer commented May 5, 2016 • edited Loading

simon3z commented May 5, 2016

moolitayer commented May 5, 2016 • edited Loading

moolitayer commented May 5, 2016

moolitayer commented May 6, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

simon3z commented May 6, 2016

Choose a reason for hiding this comment

jrafanie commented May 6, 2016

moolitayer commented May 6, 2016

moolitayer commented May 6, 2016

Choose a reason for hiding this comment

simon3z commented May 9, 2016

blomquisg May 9, 2016 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

miq-bot commented May 9, 2016

moolitayer commented Mar 27, 2016 •

edited

Loading

moolitayer commented Apr 20, 2016 •

edited

Loading

moolitayer commented May 5, 2016 •

edited

Loading

moolitayer commented May 5, 2016 •

edited

Loading

blomquisg May 9, 2016 •

edited

Loading