default-validator: allow restricting namespace adjustment.

Implement configurable restriction of namespace adjustment in
the default validator.

Signed-off-by: Krisztian Litkey <[email protected]>

Author: klihub

pkg/adaptation/adaptation_suite_test.go

@@ -1817,6 +1817,94 @@ var _ = Describe("Plugin container creation adjustments", func() {
 		})
 	})
 
+	When("the default validator is enabled and namespace adjustment is disabled", func() {
+		BeforeEach(func() {
+			s.Prepare(
+				&mockRuntime{
+					options: []nri.Option{
+						nri.WithDefaultValidator(
+							&validator.DefaultValidatorConfig{
+								Enable:                    true,
+								RejectNamespaceAdjustment: true,
+							},
+						),
+					},
+				},
+				&mockPlugin{idx: "00", name: "foo"},
+				&mockPlugin{idx: "10", name: "validator1"},
+				&mockPlugin{idx: "20", name: "validator2"},
+			)
+		})
+
+		It("should reject namespace adjustment", func() {
+			var (
+				create = func(_ *mockPlugin, _ *api.PodSandbox, ctr *api.Container) (*api.ContainerAdjustment, []*api.ContainerUpdate, error) {
+					a := &api.ContainerAdjustment{}
+					if ctr.GetName() == "ctr1" {
+						a.AddOrReplaceNamespace(
+							&api.LinuxNamespace{
+								Type: "cgroup",
+								Path: "/",
+							},
+						)
+					}
+					return a, nil, nil
+				}
+
+				validate = func(_ *mockPlugin, _ *api.ValidateContainerAdjustmentRequest) error {
+					return nil
+				}
+
+				runtime = s.runtime
+				plugins = s.plugins
+				ctx     = context.Background()
+
+				pod = &api.PodSandbox{
+					Id:        "pod0",
+					Name:      "pod0",
+					Uid:       "uid0",
+					Namespace: "default",
+				}
+				ctr0 = &api.Container{
+					Id:           "ctr0",
+					PodSandboxId: "pod0",
+					Name:         "ctr0",
+					State:        api.ContainerState_CONTAINER_CREATED,
+				}
+				ctr1 = &api.Container{
+					Id:           "ctr1",
+					PodSandboxId: "pod0",
+					Name:         "ctr1",
+					State:        api.ContainerState_CONTAINER_CREATED,
+				}
+			)
+
+			plugins[0].createContainer = create
+			plugins[1].validateAdjustment = validate
+			plugins[2].validateAdjustment = validate
+
+			s.Startup()
+			podReq := &api.RunPodSandboxRequest{Pod: pod}
+			Expect(runtime.RunPodSandbox(ctx, podReq)).To(Succeed())
+
+			ctrReq := &api.CreateContainerRequest{
+				Pod:       pod,
+				Container: ctr0,
+			}
+			reply, err := runtime.CreateContainer(ctx, ctrReq)
+			Expect(reply).ToNot(BeNil())
+			Expect(err).To(BeNil())
+
+			ctrReq = &api.CreateContainerRequest{
+				Pod:       pod,
+				Container: ctr1,
+			}
+			reply, err = runtime.CreateContainer(ctx, ctrReq)
+			Expect(err).ToNot(BeNil())
+			Expect(reply).To(BeNil())
+		})
+	})
+
 	When("the default validator is enabled with some required plugins", func() {
 		const AnnotationDomain = plugin.AnnotationDomain
 		BeforeEach(func() {

plugins/default-validator/default-validator.go

@@ -44,6 +44,8 @@ type DefaultValidatorConfig struct {
 	// RejectCustomSeccompAdjustment fails validation if a custom seccomp policy (aka LOCALHOST)
 	// is adjusted.
 	RejectCustomSeccompAdjustment bool `yaml:"rejectCustomSeccompAdjustment" toml:"reject_custom_seccomp_adjustment"`
+	// RejectNamespaceAdjustment fails validation if any plugin adjusts Linux namespaces.
+	RejectNamespaceAdjustment bool `yaml:"rejectNamespaceAdjustment" toml:"reject_namespace_adjustment"`
 	// RequiredPlugins list globally required plugins. These must be present
 	// or otherwise validation will fail.
 	// WARNING: This is a global setting and will affect all containers. In
@@ -102,6 +104,11 @@ func (v *DefaultValidator) ValidateContainerAdjustment(ctx context.Context, req
 		return err
 	}
 
+	if err := v.validateNamespaces(req); err != nil {
+		log.Errorf(ctx, "rejecting adjustment: %v", err)
+		return err
+	}
+
 	if err := v.validateRequiredPlugins(req); err != nil {
 		log.Errorf(ctx, "rejecting adjustment: %v", err)
 		return err
@@ -169,6 +176,32 @@ func (v *DefaultValidator) validateSeccompPolicy(req *api.ValidateContainerAdjus
 	return nil
 }
 
+func (v *DefaultValidator) validateNamespaces(req *api.ValidateContainerAdjustmentRequest) error {
+	if req.Adjust == nil {
+		return nil
+	}
+
+	if !v.cfg.RejectNamespaceAdjustment {
+		return nil
+	}
+
+	owners, claimed := req.Owners.NamespaceOwners(req.Container.Id)
+	if !claimed {
+		return nil
+	}
+
+	offenders := "plugin(s) "
+	sep := ""
+
+	for ns, plugin := range owners {
+		offenders += sep + fmt.Sprintf("%q (namespace %q)", plugin, ns)
+		sep = ", "
+	}
+
+	return fmt.Errorf("%w: attempted restricted namespace adjustment by %s",
+		ErrValidation, offenders)
+}
+
 func (v *DefaultValidator) validateRequiredPlugins(req *api.ValidateContainerAdjustmentRequest) error {
 	var (
 		container = req.GetContainer().GetName()