Skip to content

Commit d49932d

Browse files
robnester-rhclaude
robnester-rh
and
claude
committed
add policy rule to check Hermeto permissive mode
This commit adds a new policy rule in the `prefetch_dependencies` directory which checks the `mode` parameter to see if it is set to `permissive`. If so, it will throw a violation. Additionally, this policy rule is added to the `@redhat` collection. Ref: EC-1531 Co-authored-by: Claude <[email protected]> Signed-off-by: robnester-rh <[email protected]>
1 parent 22ee247 commit d49932d

File tree

5 files changed

+144
-0
lines changed

5 files changed

+144
-0
lines changed

‎antora/docs/modules/ROOT/pages/packages/release_prefetch_dependencies.adoc‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
= Prefetch Dependencies Task Package
2+
3+
This package verifies that the prefetch-dependencies task is invoked with appropriate parameters to ensure secure dependency fetching.
4+
5+
== Package Name
6+
7+
* `prefetch_dependencies`
8+
9+
== Rules Included
10+
11+
[#prefetch_dependencies__mode_not_permissive]
12+
=== link:#prefetch_dependencies__mode_not_permissive[Prefetch dependencies mode parameter check]
13+
14+
Verify the prefetch-dependencies task in the PipelineRun attestation was not invoked with the "permissive" mode parameter, which could compromise security.
15+
16+
*Solution*: Change the mode parameter of the prefetch-dependencies task from 'permissive' to a more secure value. The permissive mode may allow insecure dependency fetching practices.
17+
18+
* Rule type: [rule-type-indicator failure]#FAILURE#
19+
* FAILURE message: `Task 'prefetch-dependencies' was invoked with mode parameter set to 'permissive'`
20+
* Code: `prefetch_dependencies.mode_not_permissive`
21+
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/prefetch_dependencies/prefetch_dependencies.rego#L15[Source, window="_blank"]

‎antora/docs/modules/ROOT/pages/release_policy.adoc‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -140,6 +140,7 @@ Rules included:
140140
* xref:packages/release_pre_build_script_task.adoc#pre_build_script_task__valid_pre_build_script_task_runner_image_ref[Pre-build-script task checks: Script runner image is a valid image reference]
141141
* xref:packages/release_pre_build_script_task.adoc#pre_build_script_task__pre_build_script_task_runner_image_in_sbom[Pre-build-script task checks: Script runner image is included in the sbom]
142142
* xref:packages/release_pre_build_script_task.adoc#pre_build_script_task__pre_build_script_task_runner_image_in_results[Pre-build-script task checks: Script runner image is listed in the task results]
143+
* xref:packages/release_prefetch_dependencies.adoc#prefetch_dependencies__mode_not_permissive[Prefetch Dependencies Task: Prefetch dependencies mode parameter check]
143144
* xref:packages/release_provenance_materials.adoc#provenance_materials__git_clone_source_matches_provenance[Provenance Materials: Git clone source matches materials provenance]
144145
* xref:packages/release_provenance_materials.adoc#provenance_materials__git_clone_task_found[Provenance Materials: Git clone task found]
145146
* xref:packages/release_quay_expiration.adoc#quay_expiration__expires_label[Quay expiration: Expires label]
@@ -381,6 +382,9 @@ a| Checks for Operator Lifecycle Manager (OLM) bundles.
381382
| xref:packages/release_pre_build_script_task.adoc[pre_build_script_task]
382383
a| This package verifies that the pre-build-script tasks in the attestation are executed in a controlled environment
383384

385+
| xref:packages/release_prefetch_dependencies.adoc[prefetch_dependencies]
386+
a| This package verifies that the prefetch-dependencies task is invoked with appropriate parameters to ensure secure dependency fetching.
387+
384388
| xref:packages/release_provenance_materials.adoc[provenance_materials]
385389
a| This package provides rules for verifying the contents of the materials section of the SLSA Provenance attestation.
386390

‎antora/docs/modules/ROOT/partials/release_policy_nav.adoc‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,8 @@
7474
**** xref:packages/release_pre_build_script_task.adoc#pre_build_script_task__valid_pre_build_script_task_runner_image_ref[Script runner image is a valid image reference]
7575
**** xref:packages/release_pre_build_script_task.adoc#pre_build_script_task__pre_build_script_task_runner_image_in_sbom[Script runner image is included in the sbom]
7676
**** xref:packages/release_pre_build_script_task.adoc#pre_build_script_task__pre_build_script_task_runner_image_in_results[Script runner image is listed in the task results]
77+
*** xref:packages/release_prefetch_dependencies.adoc[Prefetch Dependencies Task]
78+
**** xref:packages/release_prefetch_dependencies.adoc#prefetch_dependencies__mode_not_permissive[Prefetch dependencies mode parameter check]
7779
*** xref:packages/release_provenance_materials.adoc[Provenance Materials]
7880
**** xref:packages/release_provenance_materials.adoc#provenance_materials__git_clone_source_matches_provenance[Git clone source matches materials provenance]
7981
**** xref:packages/release_provenance_materials.adoc#provenance_materials__git_clone_task_found[Git clone task found]

‎policy/release/prefetch_dependencies/prefetch_dependencies.rego‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
#
2+
# METADATA
3+
# title: Prefetch Dependencies Task
4+
# description: >-
5+
# This package verifies that the prefetch-dependencies task is invoked with
6+
# appropriate parameters to ensure secure dependency fetching.
7+
#
8+
package prefetch_dependencies
9+
10+
import rego.v1
11+
12+
import data.lib
13+
import data.lib.tekton
14+
15+
# METADATA
16+
# title: Prefetch dependencies mode parameter check
17+
# description: >-
18+
# Verify the prefetch-dependencies task in the PipelineRun attestation was not
19+
# invoked with the "permissive" mode parameter, which could compromise security.
20+
# custom:
21+
# short_name: mode_not_permissive
22+
# failure_msg: >-
23+
# Task 'prefetch-dependencies' was invoked with mode parameter set to 'permissive'
24+
# solution: >-
25+
# Change the mode parameter of the prefetch-dependencies task from 'permissive'
26+
# to a more secure value. The permissive mode may allow insecure dependency
27+
# fetching practices.
28+
# collections:
29+
# - redhat
30+
# depends_on:
31+
# - attestation_type.known_attestation_type
32+
#
33+
deny contains result if {
34+
some attestation in lib.pipelinerun_attestations
35+
some task in tekton.tasks(attestation)
36+
some name in {"prefetch-dependencies", "prefetch-dependencies-oci-ta"}
37+
name in tekton.task_names(task)
38+
tekton.task_param(task, "mode") == "permissive"
39+
result := lib.result_helper(rego.metadata.chain(), [])
40+
}

‎policy/release/prefetch_dependencies/prefetch_dependencies_test.rego‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
package prefetch_dependencies_test
2+
3+
import rego.v1
4+
5+
import data.lib
6+
import data.prefetch_dependencies
7+
8+
test_mode_permissive_violation if {
9+
lib.assert_equal_results(prefetch_dependencies.deny, {{
10+
"code": "prefetch_dependencies.mode_not_permissive",
11+
"effective_on": "2022-01-01T00:00:00Z",
12+
"msg": "Task 'prefetch-dependencies' was invoked with mode parameter set to 'permissive'",
13+
}}) with input as _attestation("prefetch-dependencies", "permissive")
14+
}
15+
16+
test_mode_not_permissive_pass if {
17+
lib.assert_empty(prefetch_dependencies.deny) with input as _attestation("prefetch-dependencies", "strict")
18+
}
19+
20+
test_missing_mode_param_pass if {
21+
lib.assert_empty(prefetch_dependencies.deny) with input as _attestation_without_mode("prefetch-dependencies")
22+
}
23+
24+
test_task_not_present_pass if {
25+
lib.assert_empty(prefetch_dependencies.deny) with input as _attestation("some-other-task", "permissive")
26+
}
27+
28+
test_oci_ta_mode_permissive_violation if {
29+
lib.assert_equal_results(prefetch_dependencies.deny, {{
30+
"code": "prefetch_dependencies.mode_not_permissive",
31+
"effective_on": "2022-01-01T00:00:00Z",
32+
"msg": "Task 'prefetch-dependencies' was invoked with mode parameter set to 'permissive'",
33+
}}) with input as _attestation("prefetch-dependencies-oci-ta", "permissive")
34+
}
35+
36+
test_oci_ta_mode_not_permissive_pass if {
37+
lib.assert_empty(prefetch_dependencies.deny) with input as _attestation("prefetch-dependencies-oci-ta", "strict")
38+
}
39+
40+
# Helper to create attestation with mode parameter
41+
_attestation(task_name, mode) := {"attestations": [{"statement": {
42+
"_type": "https://in-toto.io/Statement/v0.1",
43+
"subject": [{"name": "registry.redhat.io/ubi8/ubi:latest"}],
44+
"predicateType": "https://slsa.dev/provenance/v0.2",
45+
"predicate": {
46+
"buildType": lib.tekton_pipeline_run,
47+
"buildConfig": {"tasks": [{
48+
"name": task_name,
49+
"ref": {
50+
"name": task_name,
51+
"kind": "Task",
52+
},
53+
"invocation": {"parameters": {
54+
"input": "$(params.prefetch-input)",
55+
"mode": mode,
56+
}},
57+
}]},
58+
},
59+
}}]}
60+
61+
# Helper to create attestation without mode parameter
62+
_attestation_without_mode(task_name) := {"attestations": [{"statement": {
63+
"_type": "https://in-toto.io/Statement/v0.1",
64+
"subject": [{"name": "registry.redhat.io/ubi8/ubi:latest"}],
65+
"predicateType": "https://slsa.dev/provenance/v0.2",
66+
"predicate": {
67+
"buildType": lib.tekton_pipeline_run,
68+
"buildConfig": {"tasks": [{
69+
"name": task_name,
70+
"ref": {
71+
"name": task_name,
72+
"kind": "Task",
73+
},
74+
"invocation": {"parameters": {"input": "$(params.prefetch-input)"}},
75+
}]},
76+
},
77+
}}]}

0 commit comments

Comments
 (0)