add selinux best practice

examples/best_practices/README.md

@@ -19,4 +19,5 @@
 | Prevent mounting of default service account    | [policy_validate_disallow_default_serviceaccount.yaml](policy_validate_disallow_default_serviceaccount.yaml)                                                                      |
 | Require a default network policy               | [policy_validate_default_network_policy.yaml](policy_validate_default_network_policy.yaml)                                                                      |
 | Require namespace quotas and limit ranges      | [policy_validate_namespace_quota.yaml](policy_validate_namespace_quota.yaml)                                                                      |
-| Allocating an FSGroup that owns the pod's volumes      | [policy_validate_fsgroup.yaml](policy_validate_fsgroup.yaml)                                                                      |
+| Require an FSGroup that owns the pod's volumes      | [policy_validate_fsgroup.yaml](policy_validate_fsgroup.yaml)                                                                      |
+| Require the SELinux level of the container      | [policy_validate_selinux_context.yaml](policy_validate_selinux_context.yaml)                                                                      |

examples/best_practices/policy_validate_selinux_context.yaml

@@ -0,0 +1,20 @@
+apiVersion: kyverno.io/v1alpha1
+kind: ClusterPolicy
+metadata:
+  name: validate-selinux-options
+spec:
+  validationFailureAction: "audit"
+  rules:
+  - name: validate-selinux-options
+    match:
+      resources:
+        kinds:
+        - Pod
+    validate:
+      message: "SELinux level should be set to s0:c123,c456"
+      pattern:
+        spec:
+          containers:
+          - securityContext:
+              seLinuxOptions:
+                level: "s0:c123,c456"

examples/best_practices/resources/resource_validate_selinux_context.yaml

@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: busybox-selinux
+  namespace: default
+spec:
+  containers:
+  - image: busybox-selinux
+    name: busybox
+    command:
+      - sleep
+      - "36000"
+    volumeMounts:
+      - name: storage
+        mountPath: /storage
+    securityContext:
+      seLinuxOptions:
+        level: ""
+  volumes:
+    - name: storage
+      emptyDir: {}

pkg/testrunner/testrunner_test.go

@@ -115,3 +115,7 @@ func Test_validate_disallow_default_serviceaccount(t *testing.T) {
 func Test_validate_fsgroup(t *testing.T) {
 	testScenario(t, "test/scenarios/test/scenario_validate_fsgroup.yaml")
 }
+
+func Test_validate_selinux_context(t *testing.T) {
+	testScenario(t, "test/scenarios/test/scenario_validate_selinux_context.yaml")
+}

test/scenarios/test/scenario_validate_selinux_context.yaml

@@ -0,0 +1,19 @@
+
+# file path relative to project root
+input:
+  policy: examples/best_practices/policy_validate_selinux_context.yaml
+  resource: examples/best_practices/resources/resource_validate_selinux_context.yaml
+expected:
+  validation:
+    policyresponse:
+      policy: validate-selinux-options
+      resource:
+        kind: Pod
+        apiVersion: v1
+        namespace: default
+        name: busybox-selinux
+      rules:
+        - name: validate-selinux-options
+          type: Validation
+          message: "Validation rule 'validate-selinux-options' failed at '/spec/containers/0/securityContext/seLinuxOptions/level/' for resource Pod/default/busybox-selinux. SELinux level should be set to s0:c123,c456"
+          success: false