Skip to content

genpolicy: Harden storage validation#320

Merged
sprt merged 4 commits intomsft-mainfrom
sprt/gp-storage-sec
Feb 28, 2025
Merged

genpolicy: Harden storage validation#320
sprt merged 4 commits intomsft-mainfrom
sprt/gp-storage-sec

Conversation

@sprt
Copy link

@sprt sprt commented Feb 25, 2025 •
edited
Loading

Merge Checklist
  • Followed patch format from upstream recommendation: https://github.com/kata-containers/community/blob/main/CONTRIBUTING.md#patch-format
    • Included a single commit in a given PR - at least unless there are related commits and each makes sense as a change on its own.
  • Aware about the PR to be merged using "create a merge commit" rather than "squash and merge" (or similar)
  • The upstream/missing label (or upstream/not-needed) has been set on the PR.
Test Methodology

@sprt sprt force-pushed the sprt/gp-storage-sec branch from 8c1376c to 74ea1fb Compare February 25, 2025 20:11
@sprt sprt added the upstream/missing PRs that are yet to be upstreamed label Feb 25, 2025
@sprt sprt force-pushed the sprt/gp-storage-sec branch from 74ea1fb to 4fb3d5a Compare February 25, 2025 20:45
@sprt sprt marked this pull request as ready for review February 25, 2025 21:59
@sprt sprt requested review from a team as code owners February 25, 2025 21:59
@danmihai1 danmihai1 requested a review from Redent0r February 25, 2025 22:10
@sprt sprt force-pushed the sprt/gp-storage-sec branch from 4fb3d5a to 75997d9 Compare February 25, 2025 23:04
manuelh-dev
manuelh-dev reviewed Feb 26, 2025
View reviewed changes
@sprt sprt force-pushed the sprt/gp-storage-sec branch 4 times, most recently from 8a5de25 to e8537f1 Compare February 27, 2025 20:40
sprt added 4 commits February 27, 2025 14:42
@sprt
genpolicy: Validate storage source
465acf9 
The storage destination is already validated in allow_mount_point().

Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
@sprt
genpolicy: Validate mount source
813f744 
After validating the storage source and destination, validate that the
mount source == storage destination.

Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
@sprt
genpolicy: Validate storage fstype
3b4f86e 
Trivial validation.

Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
@sprt
agent: Update samples
27634d5 
Update samples after improving storage validation.

Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
@sprt sprt force-pushed the sprt/gp-storage-sec branch from e8537f1 to 27634d5 Compare February 27, 2025 20:44
@sprt sprt merged commit 74606ef into msft-main Feb 28, 2025
94 of 151 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@danmihai1 danmihai1 danmihai1 approved these changes

@Redent0r Redent0r Redent0r approved these changes

+1 more reviewer

@manuelh-dev manuelh-dev manuelh-dev approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

upstream/missing PRs that are yet to be upstreamed

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@sprt @danmihai1 @Redent0r @manuelh-dev