Volume Mount With OS Directory Write Permissions

YAML Configuration

rule.yaml YAML

apiVersion: rules.spotter.dev/v1alpha1
kind: SpotterRule
metadata:
  name: spotter-workload-009
  labels:
    severity: "critical" 
    category: "workload"
  annotations:
    rules.spotter.dev/title: "Volume Mount With OS Directory Write Permissions"
    rules.spotter.dev/version: "1.0.0"
    rules.spotter.dev/cwe: "CWE-732"
    rules.spotter.dev/description: "HostPath volumes mounting sensitive OS directories should be read-only."
spec:
  match:
    resources:
      kubernetes:
        apiGroups:
          - ""
          - "apps"
        versions:
          - "v1"
        kinds:
          - Pod
          - Deployment
          - StatefulSet
          - DaemonSet
        namespaces:
          include: ["*"]
          exclude: ["kube-system", "kube-public"]
        labels:
          exclude:
            rules.spotter.dev/ignore: ["true"]
  cel: |
    (object.kind == 'Pod' && (
      (has(object.spec.containers) && object.spec.containers.exists(c,
        has(c.volumeMounts) && c.volumeMounts.exists(vm,
          (vm.mountPath.startsWith('/etc') || vm.mountPath.startsWith('/var') || vm.mountPath.startsWith('/usr') || vm.mountPath.startsWith('/bin')) &&
          ((!has(vm.readOnly) || vm.readOnly == false) || (has(vm.recursiveReadOnly) && vm.recursiveReadOnly == 'Disabled')) &&
          has(object.spec.volumes) && object.spec.volumes.exists(v, v.name == vm.name &&
            (has(v.hostPath) || has(v.emptyDir) || has(v.scaleIO) || (!has(v.configMap) && !has(v.secret))))
        )
      )) ||
      (has(object.spec.initContainers) && object.spec.initContainers.exists(c,
        has(c.volumeMounts) && c.volumeMounts.exists(vm,
          (vm.mountPath.startsWith('/etc') || vm.mountPath.startsWith('/var') || vm.mountPath.startsWith('/usr') || vm.mountPath.startsWith('/bin')) &&
          ((!has(vm.readOnly) || vm.readOnly == false) || (has(vm.recursiveReadOnly) && vm.recursiveReadOnly == 'Disabled')) &&
          has(object.spec.volumes) && object.spec.volumes.exists(v, v.name == vm.name &&
            (has(v.hostPath) || has(v.emptyDir) || has(v.scaleIO) || (!has(v.configMap) && !has(v.secret))))
        )
      ))
    )) ||
    (object.kind != 'Pod' && (
      (has(object.spec.template.spec.containers) && object.spec.template.spec.containers.exists(c,
        has(c.volumeMounts) && c.volumeMounts.exists(vm,
          (vm.mountPath.startsWith('/etc') || vm.mountPath.startsWith('/var') || vm.mountPath.startsWith('/usr') || vm.mountPath.startsWith('/bin')) &&
          ((!has(vm.readOnly) || vm.readOnly == false) || (has(vm.recursiveReadOnly) && vm.recursiveReadOnly == 'Disabled')) &&
          has(object.spec.template.spec.volumes) && object.spec.template.spec.volumes.exists(v, v.name == vm.name &&
            (has(v.hostPath) || has(v.emptyDir) || has(v.scaleIO) || (!has(v.configMap) && !has(v.secret))))
        )
      )) ||
      (has(object.spec.template.spec.initContainers) && object.spec.template.spec.initContainers.exists(c,
        has(c.volumeMounts) && c.volumeMounts.exists(vm,
          (vm.mountPath.startsWith('/etc') || vm.mountPath.startsWith('/var') || vm.mountPath.startsWith('/usr') || vm.mountPath.startsWith('/bin')) &&
          ((!has(vm.readOnly) || vm.readOnly == false) || (has(vm.recursiveReadOnly) && vm.recursiveReadOnly == 'Disabled')) &&
          has(object.spec.template.spec.volumes) && object.spec.template.spec.volumes.exists(v, v.name == vm.name &&
            (has(v.hostPath) || has(v.emptyDir) || has(v.scaleIO) || (!has(v.configMap) && !has(v.secret))))
        )
      ))
    ))
  remediation:
    manual: "Set `readOnly: true` for hostPath volume mounts that access sensitive OS directories."
  references:
    - title: "Volumes - hostPath"
      url: "https://kubernetes.io/docs/concepts/storage/volumes/#hostpath"

Test Cases

test-cases.yaml YAML

- name: insecure sample 1 should fail
  pass: false
  input: |-
    apiVersion: v1
    kind: Pod
    metadata:
      name: pod-0
    spec:
      containers:
      - image: k8s.gcr.io/test-webserver
        name: pod-0
        volumeMounts:
        - mountPath: /bin
          name: vol-0
        - mountPath: /var
          name: vol-1
          recursiveReadOnly: Disabled
      volumes:
      - name: vol-0
        scaleIO:
          gateway: https://localhost:443/api
          system: scaleio
          protectionDomain: sd0
          storagePool: sp1
          volumeName: vol-0
          secretRef:
            name: sio-secret
          fsType: xfs
- name: insecure sample 2 should fail
  pass: false
  input: |-
    apiVersion: v1
    kind: Pod
    metadata:
      name: pod-1
    spec:
      containers:
      - image: k8s.gcr.io/test-webserver
        name: pod-1
        volumeMounts:
        - mountPath: /var
          name: vol-0
          recursiveReadOnly: Enabled
        - mountPath: /bin
          name: vol-1
          readOnly: false
      volumes:
      - name: vol-0
        scaleIO:
          gateway: https://localhost:443/api
          system: scaleio
          protectionDomain: sd0
          storagePool: sp1
          volumeName: vol-0
          secretRef:
            name: sio-secret
          fsType: xfs
- name: insecure sample 3 should fail
  pass: false
  input: |-
    apiVersion: v1
    kind: Pod
    metadata:
      name: pod-0
    spec:
      containers:
        - name: pod-0
          image: k8s.gcr.io/test-webserver
          volumeMounts:
            - mountPath: /bin
              name: vol-0
              readOnly: false
              recursiveReadOnly: Disabled
            - mountPath: /var
              name: vol-1
              readOnly: false
              recursiveReadOnly: Enabled
      volumes:
        - name: vol-0
          emptyDir: {}
        - name: vol-1
          emptyDir: {}
- name: insecure sample 4 should fail
  pass: false
  input: |-
    apiVersion: v1
    kind: Pod
    metadata:
      name: pod-1
    spec:
      containers:
        - name: pod-1
          image: k8s.gcr.io/test-webserver
          volumeMounts:
            - mountPath: /var
              name: vol-0
              readOnly: true
            - mountPath: /bin
              name: vol-1
              readOnly: true
              recursiveReadOnly: Disabled
      volumes:
        - name: vol-0
          emptyDir: {}
        - name: vol-1
          emptyDir: {}
- name: secure sample 1 should pass
  pass: true
  input: |-
    apiVersion: v1
    kind: Pod
    metadata:
      name: pod-0
    spec:
      containers:
      - image: k8s.gcr.io/test-webserver
        name: pod-0
        volumeMounts:
        - mountPath: /bin
          name: vol-0
          readOnly: true
          recursiveReadOnly: Enabled
      volumes:
      - name: vol-0
        scaleIO:
          gateway: https://localhost:443/api
          system: scaleio
          protectionDomain: sd0
          storagePool: sp1
          volumeName: vol-0
          secretRef:
            name: sio-secret
          fsType: xfs
- name: secure sample 2 should pass
  pass: true
  input: |-
    apiVersion: v1
    kind: Pod
    metadata:
      name: pod-1
    spec:
      containers:
      - image: k8s.gcr.io/test-webserver
        name: pod-0
        volumeMounts:
        - mountPath: /project-mount
          name: vol-0
      volumes:
      - name: vol-0
        scaleIO:
          gateway: https://localhost:443/api
          system: scaleio
          protectionDomain: sd0
          storagePool: sp1
          volumeName: vol-0
          secretRef:
            name: sio-secret
          fsType: xfs
- name: secure sample 3 should pass
  pass: true
  input: |-
    apiVersion: v1
    kind: Pod
    metadata:
      name: pod-2
    spec:
      containers:
      - image: k8s.gcr.io/test-webserver
        name: pod-0
        volumeMounts:
        - mountPath: /var/run
          name: vol-0
          readOnly: true
          recursiveReadOnly: Enabled
      volumes:
      - name: vol-0
        scaleIO:
          gateway: https://localhost:443/api
          system: scaleio
          protectionDomain: sd0
          storagePool: sp1
          volumeName: vol-0
          secretRef:
            name: sio-secret
          fsType: xfs
- name: secure sample 4 should pass
  pass: true
  input: |-
    apiVersion: v1
    kind: ConfigMap
    metadata:
      name: log-config
    data:
      log_level: "INFO"
- name: secure sample 5 should pass
  pass: true
  input: |-
    apiVersion: v1
    kind: Pod
    metadata:
      name: configmap-pod
    spec:
      volumes:
        - name: config-vol
          configMap:
            name: log-config
            items:
              - key: log_level
                path: log_level.conf
      containers:
        - name: test
          image: busybox:1.28
          volumeMounts:
            - name: config-vol
              mountPath: /etc/config
- name: secure sample 6 should pass
  pass: true
  input: |-
    apiVersion: v1
    kind: Secret
    metadata:
      name: my-secret
    type: Opaque
    data:
      password: cGFzc3dvcmQxMjM=  # base64 for "password123"
- name: secure sample 7 should pass
  pass: true
  input: |-
    apiVersion: v1
    kind: Pod
    metadata:
      name: secret-pod
    spec:
      containers:
        - name: test
          image: busybox:1.28
          command: ['sh', '-c', 'echo "Secret volume mounted" && tail -f /dev/null']
          volumeMounts:
            - name: secret-vol
              mountPath: /etc/secret
      volumes:
        - name: secret-vol
          secret:
            secretName: my-secret

Validating Admission Policy

validating-admission-policy.yaml YAML

# VAP export for spotter-workload-009
# Generated from Spotter rule
apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingAdmissionPolicy
metadata:
  name: spotter-workload-009
spec:
  # Add your VAP configuration here

Rule Metadata

Volume Mount With OS Directory Write Permissions

YAML Configuration

Test Cases

Validating Admission Policy

Rule Metadata

Rule Information

Tags & Compliance

Compliance Standards

General Tags

Spotter Hub