Least Permissive Policies for OAI (Nephio based)

5gsec/oai-core/ksp-core-amf-zero-trust.yaml

@@ -0,0 +1,51 @@
+apiVersion: security.kubearmor.com/v1
+kind: KubeArmorPolicy
+metadata:
+  name: ksp-core-amf-zero-trust
+  namespace: oai-core
+spec:
+  action: Allow
+  file:
+    matchDirectories:
+    - dir: /
+      recursive: true
+    - dir: /openair-amf/etc/
+      recursive: true
+      action: Block
+    - dir: /openair-amf/etc/
+      recursive: true
+      fromSource:
+      - path: /openair-amf/bin/oai_amf
+    - dir: /run/secrets/kubernetes.io/serviceaccount/
+      action: Block
+      message: unauthorized access to kubernetes service account
+    - dir: /run/secrets/kubernetes.io/serviceaccount/
+      action: Allow
+      fromSource:
+      - path: /openair-amf/bin/oai_amf
+    matchPaths:
+    - path: /openair-amf/etc/amf.yaml
+      action: Block
+    - path: /openair-amf/etc/amf.yaml
+      fromSource:
+      - path: /openair-amf/bin/oai_amf
+
+
+  network:
+    matchProtocols:
+    - fromSource:
+      - path: /openair-amf/bin/oai_amf
+      protocol: raw
+    - fromSource:
+      - path: /openair-amf/bin/oai_amf
+      protocol: tcp
+    - fromSource:
+      - path: /openair-amf/bin/oai_amf
+      protocol: udp
+  process:
+    matchPaths:
+    - path: /openair-amf/bin/oai_amf
+  selector:
+    matchLabels:
+      workload.nephio.org/oai: amf
+  severity: 1

5gsec/oai-core/ksp-core-ausf-zero-trust.yaml

@@ -0,0 +1,51 @@
+apiVersion: security.kubearmor.com/v1
+kind: KubeArmorPolicy
+metadata:
+  name: ksp-core-ausf-zero-trust
+  namespace: oai-core
+spec:
+  action: Allow
+  file:
+    matchDirectories:
+    - dir: /
+      recursive: true
+    - dir: /openair-ausf/etc/
+      recursive: true
+      action: Block
+    - dir: /openair-ausf/etc/
+      recursive: true
+      fromSource:
+      - path: /openair-ausf/bin/oai_ausf
+    - dir: /run/secrets/kubernetes.io/serviceaccount/
+      action: Block
+      message: unauthorized access to kubernetes service account
+    - dir: /run/secrets/kubernetes.io/serviceaccount/
+      action: Allow
+      fromSource:
+      - path: /openair-ausf/bin/oai_ausf
+    matchPaths:
+    - path: /openair-ausf/etc/ausf.yaml
+      action: Block
+    - path: /openair-ausf/etc/ausf.yaml
+      fromSource:
+      - path: /openair-ausf/bin/oai_ausf
+
+
+  network:
+    matchProtocols:
+    - fromSource:
+      - path: /openair-ausf/bin/oai_ausf
+      protocol: raw
+    - fromSource:
+      - path: /openair-ausf/bin/oai_ausf
+      protocol: tcp
+    - fromSource:
+      - path: /openair-ausf/bin/oai_ausf
+      protocol: udp
+  process:
+    matchPaths:
+    - path: /openair-ausf/bin/oai_ausf
+  selector:
+    matchLabels:
+      workload.nephio.org/oai: ausf
+  severity: 1

5gsec/oai-core/ksp-core-nrf-zero-trust.yaml

@@ -0,0 +1,51 @@
+apiVersion: security.kubearmor.com/v1
+kind: KubeArmorPolicy
+metadata:
+  name: ksp-core-nrf-zero-trust
+  namespace: oai-core
+spec:
+  action: Allow
+  file:
+    matchDirectories:
+    - dir: /
+      recursive: true
+    - dir: /openair-nrf/etc/
+      recursive: true
+      action: Block
+    - dir: /openair-nrf/etc/
+      recursive: true
+      fromSource:
+      - path: /openair-nrf/bin/oai_nrf
+    - dir: /run/secrets/kubernetes.io/serviceaccount/
+      action: Block
+      message: unauthorized access to kubernetes service account
+    - dir: /run/secrets/kubernetes.io/serviceaccount/
+      action: Allow
+      fromSource:
+      - path: /openair-nrf/bin/oai_nrf
+    matchPaths:
+    - path: /openair-nrf/etc/nrf.yaml
+      action: Block
+    - path: /openair-nrf/etc/nrf.yaml
+      fromSource:
+      - path: /openair-nrf/bin/oai_nrf
+
+
+  network:
+    matchProtocols:
+    - fromSource:
+      - path: /openair-nrf/bin/oai_nrf
+      protocol: raw
+    - fromSource:
+      - path: /openair-nrf/bin/oai_nrf
+      protocol: tcp
+    - fromSource:
+      - path: /openair-nrf/bin/oai_nrf
+      protocol: udp
+  process:
+    matchPaths:
+    - path: /openair-nrf/bin/oai_nrf
+  selector:
+    matchLabels:
+      workload.nephio.org/oai: nrf
+  severity: 1

5gsec/oai-core/ksp-core-smf-zero-trust.yaml

@@ -0,0 +1,51 @@
+apiVersion: security.kubearmor.com/v1
+kind: KubeArmorPolicy
+metadata:
+  name: ksp-core-smf-zero-trust
+  namespace: oai-core
+spec:
+  action: Allow
+  file:
+    matchDirectories:
+    - dir: /
+      recursive: true
+    - dir: /openair-smf/etc/
+      recursive: true
+      action: Block
+    - dir: /openair-smf/etc/
+      recursive: true
+      fromSource:
+      - path: /openair-smf/bin/oai_smf
+    - dir: /run/secrets/kubernetes.io/serviceaccount/
+      action: Block
+      message: unauthorized access to kubernetes service account
+    - dir: /run/secrets/kubernetes.io/serviceaccount/
+      action: Allow
+      fromSource:
+      - path: /openair-smf/bin/oai_smf
+    matchPaths:
+    - path: /openair-smf/etc/smf.yaml
+      action: Block
+    - path: /openair-smf/etc/smf.yaml
+      fromSource:
+      - path: /openair-smf/bin/oai_smf
+
+
+  network:
+    matchProtocols:
+    - fromSource:
+      - path: /openair-smf/bin/oai_smf
+      protocol: raw
+    - fromSource:
+      - path: /openair-smf/bin/oai_smf
+      protocol: tcp
+    - fromSource:
+      - path: /openair-smf/bin/oai_smf
+      protocol: udp
+  process:
+    matchPaths:
+    - path: /openair-smf/bin/oai_smf
+  selector:
+    matchLabels:
+      workload.nephio.org/oai: smf
+  severity: 1

5gsec/oai-core/ksp-core-udm-zero-trust.yaml

@@ -0,0 +1,51 @@
+apiVersion: security.kubearmor.com/v1
+kind: KubeArmorPolicy
+metadata:
+  name: ksp-core-udm-zero-trust
+  namespace: oai-core
+spec:
+  action: Allow
+  file:
+    matchDirectories:
+    - dir: /
+      recursive: true
+    - dir: /openair-udm/etc/
+      recursive: true
+      action: Block
+    - dir: /openair-udm/etc/
+      recursive: true
+      fromSource:
+      - path: /openair-udm/bin/oai_udm
+    - dir: /run/secrets/kubernetes.io/serviceaccount/
+      action: Block
+      message: unauthorized access to kubernetes service account
+    - dir: /run/secrets/kubernetes.io/serviceaccount/
+      action: Allow
+      fromSource:
+      - path: /openair-udm/bin/oai_udm
+    matchPaths:
+    - path: /openair-udm/etc/udm.yaml
+      action: Block
+    - path: /openair-udm/etc/udm.yaml
+      fromSource:
+      - path: /openair-udm/bin/oai_udm
+
+
+  network:
+    matchProtocols:
+    - fromSource:
+      - path: /openair-udm/bin/oai_udm
+      protocol: raw
+    - fromSource:
+      - path: /openair-udm/bin/oai_udm
+      protocol: tcp
+    - fromSource:
+      - path: /openair-udm/bin/oai_udm
+      protocol: udp
+  process:
+    matchPaths:
+    - path: /openair-udm/bin/oai_udm
+  selector:
+    matchLabels:
+      workload.nephio.org/oai: udm
+  severity: 1

5gsec/oai-core/ksp-core-udr-zero-trust.yaml

@@ -0,0 +1,51 @@
+apiVersion: security.kubearmor.com/v1
+kind: KubeArmorPolicy
+metadata:
+  name: ksp-core-udr-zero-trust
+  namespace: oai-core
+spec:
+  action: Allow
+  file:
+    matchDirectories:
+    - dir: /
+      recursive: true
+    - dir: /openair-udr/etc/
+      recursive: true
+      action: Block
+    - dir: /openair-udr/etc/
+      recursive: true
+      fromSource:
+      - path: /openair-udr/bin/oai_udr
+    - dir: /run/secrets/kubernetes.io/serviceaccount/
+      action: Block
+      message: unauthorized access to kubernetes service account
+    - dir: /run/secrets/kubernetes.io/serviceaccount/
+      action: Allow
+      fromSource:
+      - path: /openair-udr/bin/oai_udr
+    matchPaths:
+    - path: /openair-udr/etc/udr.yaml
+      action: Block
+    - path: /openair-udr/etc/udr.yaml
+      fromSource:
+      - path: /openair-udr/bin/oai_udr
+
+
+  network:
+    matchProtocols:
+    - fromSource:
+      - path: /openair-udr/bin/oai_udr
+      protocol: raw
+    - fromSource:
+      - path: /openair-udr/bin/oai_udr
+      protocol: tcp
+    - fromSource:
+      - path: /openair-udr/bin/oai_udr
+      protocol: udp
+  process:
+    matchPaths:
+    - path: /openair-udr/bin/oai_udr
+  selector:
+    matchLabels:
+      workload.nephio.org/oai: udr
+  severity: 1

5gsec/oai-core/ksp-core-upf-zero-trust.yaml

@@ -0,0 +1,51 @@
+apiVersion: security.kubearmor.com/v1
+kind: KubeArmorPolicy
+metadata:
+  name: ksp-core-upf-zero-trust
+  namespace: oai-core
+spec:
+  action: Allow
+  file:
+    matchDirectories:
+    - dir: /
+      recursive: true
+    - dir: /openair-upf/etc/
+      recursive: true
+      action: Block
+    - dir: /openair-upf/etc/
+      recursive: true
+      fromSource:
+      - path: /openair-upf/bin/oai_upf
+    - dir: /run/secrets/kubernetes.io/serviceaccount/
+      action: Block
+      message: unauthorized access to kubernetes service account
+    - dir: /run/secrets/kubernetes.io/serviceaccount/
+      action: Allow
+      fromSource:
+      - path: /openair-upf/bin/oai_upf
+    matchPaths:
+    - path: /openair-upf/etc/upf.yaml
+      action: Block
+    - path: /openair-upf/etc/upf.yaml
+      fromSource:
+      - path: /openair-upf/bin/oai_upf
+
+
+  network:
+    matchProtocols:
+    - fromSource:
+      - path: /openair-upf/bin/oai_upf
+      protocol: raw
+    - fromSource:
+      - path: /openair-upf/bin/oai_upf
+      protocol: tcp
+    - fromSource:
+      - path: /openair-upf/bin/oai_upf
+      protocol: udp
+  process:
+    matchPaths:
+    - path: /openair-upf/bin/oai_upf
+  selector:
+    matchLabels:
+      workload.nephio.org/oai: upf
+  severity: 1

5gsec/oai-core/kyverno-core-readonly-volume-mounts.yaml

@@ -0,0 +1,21 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: kyverno-core-readonly-volume-mounts
+spec:
+  validationFailureAction: enforce
+  rules:
+    - name: check-readonly-volumes
+      match:
+        resources:
+          kinds:
+            - Pod
+          namespaces:
+            - oai-core
+      validate:
+        message: "All volume mounts must be read-only."
+        pattern:
+          spec:
+            containers:
+              - volumeMounts:
+                  - readOnly: true