5gsec/nimbus

Intent driven security automation framework

Nimbus: Intent Driven Security Operator

The aim for any organization should be to state its security goal/intents and the underlying tooling/operator should be able to convert these goals/intents into actionable elements such as policies/rules.

Nimbus aims to decouple security intents from its actual implementation i.e., use of policy engines and corresponding policies and rules. This pattern exists commonly in Kubernetes world and the best example is a storage operator, wherein the user specifies the persistent volume claims with appropriate SLA (disk space, R/W, speed) and the operator figures out the appropriate volume to bind. Nimbus intends to bring in similar abstraction for security intents wherein the user specifies the security intent and the operator figures out the best implementation method available given the deployment.

• An Intent might get translated into a set of policies and not necessarily a single policy thus providing multi-layer defense. For example, an intent such as "Do not allow privilege escalation" could get translated in to admission controller policy and system policy as handled by runtime security engines such as KubeArmor.
• An intent could take into consideration runtime behavior and then handle intent implementation. For e.g., an intent could be "Do not allow privilege flags for pods that are publicly reachable".
• An intent might get fully or partially satisfied and the bindings clearly shows that status.
• An organization can provide a blueprint of intents given a deployment and the operator could go an try to satisfy those intents in best-effort or strict mode.

• Getting Started
• Quick Tutorials
• Contribution guide

Credits

This project is funded by NSF grant ...

nimbus's Issues

Finalise server side printing, for kubectl get si,sib,csib,np,cwnp’

Cilium Network Policy Adapter: DNS Manipulation Intent

Data exfiltration can occur through malicious domain names

Using CiliumNetworkPolicy we can specify a fqdn whitelist as a CRD.

The destination DNS requests should be restricted to this whitelist

This fqdn whitelist could also be generated by the discovery engine

KubeArmor Adapter: Escape to Host

Use a per-process capability list to prevent escape to Host

https://www.panoptica.app/research/7-ways-to-escape-a-container

Prevent Execution from tmp / log folders : Exploit Public facing applications

Protecting system folder; /tmp; this should take care of most of the attacks as the attack binaries are loaded into these folders

Do not allow binary execution from a list of folders.

The intent is implemented by the KubeArmor adapter

ServiceMesh Adapter

The following intents might be part of this:

• WAF

More details needed here..

LimitUseOfPrivilegedAccess

Techniques:

1. Valid Accounts
2. Impair Defenses
3. Container Administration Command

Bug: Deletion of SIB results in crash

Description

After successfully applying the SecurityIntent (SI) and SecurityIntentBinding (SIB), if we try to delete the SIB then nimbus crashes. However, SIB gets deleted from the k8s API server.

Steps to reproduce

1. Run nimbus make run
2. Start HTTP server go run pkg/nimbus-kubearmor/receiver/server/server.go
3. Apply SI and SIB
4. Delete SIB
   And then the nimbus crashes.

Expected behaviour

nimbus should not crash on the deletion of SIB.

Additional context

Network Policy: DNS Manipulation Intent

Ensure that DNS traffic is always forwarded to kube-dns-service

DNS Logging: DNS Manipulation Intent

An adversary can piggyback user data within DNS requests, so that the DNS server retrieves the user data for further processing.

The detection technique involves logging the DNS requests

The adapter used is KubeArmor, and the API logging work [https://github.com//issues/112] item tracks the adapter/security engine work

This detection technique is not part of the MITRE FiGHT

API Logging

This work item needs review from the NSF team as jaehyun is also working on eBPF based monitoring of HTTP:

API Logging Intent can detect below techniques

• Unauthorized access to Network Exposure Function (NEF) via token fraud: DS0015: Logs of connection attempts to NEF
• Trusted Relationships: DS0015: Monitor logs for unexpected actions taken by any delegated administrator accounts (WebUI)

One possible approach is

• This intent uses the kubeArmor adapter to trigger KubeArmor to initiate API logging.
• API logging can be configured on ip:port number. This parameter will have to be supplied by the intent. NEF endpoint, WebUI endpoints
• The logs can be streamed to SentryFlow

[Core]: Nimbus crashes on updating CEL for the resource which is not present

Description

If we specify the CEL expression to select resources in the SecurityIntentBinding (SIB) selector and if there is a typo or the resource itself doesn't exist in the cluster then nimbus crashes.

Steps to reproduce

1. Run nimbus

make run

3. Apply cel-based SI + SIB

kubectl apply -f  examples/namespaced/cel-multi-si-sib-namespaced.yaml

4. Edit SIB selector's CEL for a resource that doesn't exist or try a typo.
   E.g., labels["app"] == "nginx" to labels["app"] == "ngin"

kubectl edit sib multiple-sis-nsscoped-binding

and then nimbus crashes with following logs:

...
2024-02-14T15:09:29+05:30       ERROR   No labels matched the CEL expressions, aborting NimbusPolicy creation due to missing keys in labels     {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"multiple-sis-nsscoped-binding","namespace":"default"}, "namespace": "default", "name": "multiple-sis-nsscoped-binding", "reconcileID": "01a3e488-1554-485a-ac60-23ce451636e6"}
github.com/5GSEC/nimbus/pkg/processor/policybuilder.BuildNimbusPolicy
        /Users/anurag/workspace/nimbus/pkg/processor/policybuilder/nimbuspolicy_builder.go:76
github.com/5GSEC/nimbus/internal/controller.(*SecurityIntentBindingReconciler).Reconcile
        /Users/anurag/workspace/nimbus/internal/controller/securityintentbinding_controller.go:66
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile
        /Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:119
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler
        /Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:316
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
        /Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:266
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
        /Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:227
2024-02-14T15:09:29+05:30       INFO    Observed a panic in reconciler: runtime error: invalid memory address or nil pointer dereference        {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"multiple-sis-nsscoped-binding","namespace":"default"}, "namespace": "default", "name": "multiple-sis-nsscoped-binding", "reconcileID": "01a3e488-1554-485a-ac60-23ce451636e6"}
panic: runtime error: invalid memory address or nil pointer dereference [recovered]
        panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x2 addr=0x78 pc=0x101b66904]

goroutine 125 [running]:
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile.func1()
        /Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:116 +0x1a4
panic({0x101f9dc40?, 0x102ef3460?})
        /opt/homebrew/opt/go/libexec/src/runtime/panic.go:914 +0x218
github.com/5GSEC/nimbus/internal/controller.(*SecurityIntentBindingReconciler).Reconcile(0x1400000fd28, {0x1021f81b0, 0x1400020ac60}, {{{0x140003283e0?, 0x5?}, {0x140006e6380?, 0x14000741cf8?}}})
        /Users/anurag/workspace/nimbus/internal/controller/securityintentbinding_controller.go:81 +0x604
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile(0x1021fbe40?, {0x1021f81b0?, 0x1400020ac60?}, {{{0x140003283e0?, 0xb?}, {0x140006e6380?, 0x0?}}})
        /Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:119 +0x8c
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler(0x140006a0500, {0x1021f81e8, 0x140004dbae0}, {0x102024000?, 0x140000ce6c0?})
        /Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:316 +0x2e8
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem(0x140006a0500, {0x1021f81e8, 0x140004dbae0})
        /Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:266 +0x16c
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2()
        /Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:227 +0x74
created by sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2 in goroutine 77
        /Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:223 +0x43c
exit status 2
make: *** [run] Error 1

Expected behaviour

Nimbus should handle gracefully scenarios where resources referenced in CEL expressions are either missing or contain typos.

k8tls Adapter

k8tls enhancements for FIPS compliance are work item in the API Security Project

This Adapter will consume an intent - EnsureTLS - and create jobs to run the k8tls tool at periodic intervals to generate reports.

These reports will need to be accessed karmor CLI, and/or pushed to CNAPP

Helm Chart for Nimbus

P0

This will require a simple helm chart which installs the necessary resources

Admission Controller Adapter: Escape to Host

To prevent mounted docker socket: Kyverno has a policy - https://kyverno.io/policies/best-practices/disallow-cri-sock-mount/disallow-cri-sock-mount/

• Ensure containerized workloads do not run as root
• Create a Kyverno PSA policy in a restricted profile for namespaced scope.
• If possible create a ClusterScoped Policy which comes out of the box in Kyverno to apply it on multiple namespaces.

Ref:
https://github.com/DataDog/dirtypipe-container-breakout-poc

Add params based pss profile feature in Kyverno Adapter.

[Core]: Error while creating, editing or deleting SI and SIB

Description

Nimbus logs error messages when we create, update or delete SIB, however, the resources including the NP get created, updated or deleted.

Some of these operations are hard to reproduce.

Steps to reproduce

1. Run nimbus and keep an eye on its log

make run

2. Apply SI and SIB

kubectl apply -f examples/namespaced/pkg-mgr-exec-si-sib.yaml

3. Edit or delete the SI and SIB created in the previous step. If you're not getting error logs edit it again to reproduce

and check logs

...
...
2024-02-14T21:40:37+05:30       ERROR   failed to update NimbusPolicy   {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "c2becafc-3fa9-4fdb-8574-040eec46dd38", "error": "NimbusPolicy.intent.security.nimbus.com \"pkg-mgr-execution-binding\" is invalid: spec.rules: Required value"}
github.com/5GSEC/nimbus/internal/controller.(*SecurityIntentBindingReconciler).Reconcile
        /Users/anurag/workspace/nimbus/internal/controller/securityintentbinding_controller.go:99
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile
        /Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:119
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler
        /Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:316
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
        /Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:266
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
        /Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:227
2024-02-14T21:40:37+05:30       ERROR   Reconciler error        {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "c2becafc-3fa9-4fdb-8574-040eec46dd38", "error": "NimbusPolicy.intent.security.nimbus.com \"pkg-mgr-execution-binding\" is invalid: spec.rules: Required value"}
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler
        /Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:329
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
        /Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:266
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
        /Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:227
2024-02-14T21:40:37+05:30       INFO    SecurityIntentBinding not found. Ignoring since object must be deleted  {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "e79a294b-e307-45db-a099-cdb27ccc7256"}
2024-02-14T21:40:37+05:30       INFO    SecurityIntentBinding not found. Ignoring since object must be deleted  {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "0efc000c-51e9-4394-ace0-961eaa515e18"}
2024-02-14T21:40:37+05:30       INFO    SecurityIntentBinding not found. Ignoring since object must be deleted  {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "d0ae5415-c5a2-41b9-8dc6-cfd821c6ece1"}

or

...
...
 ERROR   failed to update SecurityIntentBinding status after NimbusPolicy operation      {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "034cc08c-708a-4bb9-b98f-50fcd627a875", "SecurityIntentBinding.Name": "pkg-mgr-execution-binding", "SecurityIntentBinding.Namespace": "default", "error": "Operation cannot be fulfilled on securityintentbindings.intent.security.nimbus.com \"pkg-mgr-execution-binding\": the object has been modified; please apply your changes to the latest version and try again"}
github.com/5GSEC/nimbus/internal/controller.(*SecurityIntentBindingReconciler).Reconcile
        /Users/anurag/workspace/nimbus/internal/controller/securityintentbinding_controller.go:93
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile
        /Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:119
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler
        /Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:316
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
        /Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:266
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
        /Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:227
2024-02-14T21:50:44+05:30       ERROR   Reconciler error        {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "034cc08c-708a-4bb9-b98f-50fcd627a875", "error": "Operation cannot be fulfilled on securityintentbindings.intent.security.nimbus.com \"pkg-mgr-execution-binding\": the object has been modified; please apply your changes to the latest version and try again"}
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler
        /Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:329
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
        /Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:266
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
        /Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:227

or sometimes you may get similar logs as follows:

...
...
2024-02-14T22:03:21+05:30       INFO    SecurityIntentBinding not found. Ignoring since object must be deleted  {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "8e5e0b5a-50c2-4fea-8f64-a0d01ccef662"}
2024-02-14T22:03:21+05:30       ERROR   Failed to update SecurityIntentBinding after SI deletion/update {"controller": "securityintent", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntent", "SecurityIntent": {"name":"pkg-mgr-execution"}, "namespace": "", "name": "pkg-mgr-execution", "reconcileID": "b9c9b50b-601e-4e60-9a5e-a28311d9a495", "SecurityIntentBinding.Name": "pkg-mgr-execution-binding", "error": "Operation cannot be fulfilled on securityintentbindings.intent.security.nimbus.com \"pkg-mgr-execution-binding\": StorageError: invalid object, Code: 4, Key: /registry/intent.security.nimbus.com/securityintentbindings/default/pkg-mgr-execution-binding, ResourceVersion: 0, AdditionalErrorMsg: Precondition failed: UID in precondition: 3baceb47-0c84-48d4-9a46-efdfcb9c21b1, UID in object meta: "}
github.com/5GSEC/nimbus/internal/controller.(*SecurityIntentReconciler).updateRelatedSIBs
        /Users/anurag/workspace/nimbus/internal/controller/securityintent_controller.go:113
github.com/5GSEC/nimbus/internal/controller.(*SecurityIntentReconciler).Reconcile
        /Users/anurag/workspace/nimbus/internal/controller/securityintent_controller.go:39
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile
        /Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:119
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler
        /Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:316
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
        /Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:266
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
        /Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:227
2024-02-14T22:03:21+05:30       ERROR   failed to update related SecurityIntentBindings after SI deletion       {"controller": "securityintent", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntent", "SecurityIntent": {"name":"pkg-mgr-execution"}, "namespace": "", "name": "pkg-mgr-execution", "reconcileID": "b9c9b50b-601e-4e60-9a5e-a28311d9a495", "SecurityIntent.Name": "pkg-mgr-execution", "error": "Operation cannot be fulfilled on securityintentbindings.intent.security.nimbus.com \"pkg-mgr-execution-binding\": StorageError: invalid object, Code: 4, Key: /registry/intent.security.nimbus.com/securityintentbindings/default/pkg-mgr-execution-binding, ResourceVersion: 0, AdditionalErrorMsg: Precondition failed: UID in precondition: 3baceb47-0c84-48d4-9a46-efdfcb9c21b1, UID in object meta: "}
github.com/5GSEC/nimbus/internal/controller.(*SecurityIntentReconciler).Reconcile
        /Users/anurag/workspace/nimbus/internal/controller/securityintent_controller.go:40
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile
        /Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:119
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler
        /Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:316
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
        /Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:266
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
        /Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:227
2024-02-14T22:03:21+05:30       ERROR   Reconciler error        {"controller": "securityintent", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntent", "SecurityIntent": {"name":"pkg-mgr-execution"}, "namespace": "", "name": "pkg-mgr-execution", "reconcileID": "b9c9b50b-601e-4e60-9a5e-a28311d9a495", "error": "Operation cannot be fulfilled on securityintentbindings.intent.security.nimbus.com \"pkg-mgr-execution-binding\": StorageError: invalid object, Code: 4, Key: /registry/intent.security.nimbus.com/securityintentbindings/default/pkg-mgr-execution-binding, ResourceVersion: 0, AdditionalErrorMsg: Precondition failed: UID in precondition: 3baceb47-0c84-48d4-9a46-efdfcb9c21b1, UID in object meta: "}
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler
        /Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:329
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
        /Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:266
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
        /Users/anurag/.local/share/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:227
2024-02-14T22:03:21+05:30       INFO    SecurityIntent not found. Ignoring since object must be deleted {"controller": "securityintent", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntent", "SecurityIntent": {"name":"pkg-mgr-execution"}, "namespace": "", "name": "pkg-mgr-execution", "reconcileID": "f7e2d218-8325-4dff-aaeb-ac194531c58e"}
2024-02-14T22:03:21+05:30       INFO    SecurityIntentBinding not found. Ignoring since object must be deleted  {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "84467062-486d-4123-97f9-6a774e1a7618"}

Expected behaviour

Nimbus should not log error messages while performing create, update or delete operations on SIB or NP.

Nimbus: Provide feature to match, or exclude namespaces

We need to have a feature to match / exclude namespaces for a policy.

Design document - https://docs.google.com/document/d/1-zxAMBpX-ZdpmDTjS0qzmFk5pueOCtLaGa970KJLTNc/edit?usp=sharing

add chainsaw tests for nimbus-kyverno adapter

Support ownership tracking for adapter policies, which are referenced to the Nimbus policy.

Required.. PR is opened

Valid Accounts: PreventCredsInManifests

Implemented by Kyverno Adapter

File Integrity Monitoring

DS0022: is a FIle data source.

Using this intent, following techniques are mitigated

• Supply Chain compromise
• Software Deployment tools
• gNodeB component manipulation
• Pre-OS Boot
• Multiple VNF configuration
• Rootkit
• Impair defenses
• Weaken encryption

[Core]: Add integration tests

Add integration tests for controllers in the core to verify the NimbusPolicy and ClusterNimbusPolicy generation.

Scenarios to test:

Create and Read

• Scenario: Create a SecurityIntent and a SecurityIntentBinding.

• Expected outcomes:

  • An intermediary NimbusPolicy is generated with the expected values populated correctly.

  • The created SecurityIntent status subresource includes the ID and action fields with the intent values.
    The created SecurityIntentBinding status subresource reflects the number and names of bound intents, along with the generated NimbusPolicy name.

• Similar test cases for a SecurityIntent with a ClusterSecurityIntentBinding, expecting a ClusterNimbusPolicy generation.

Update

• Scenario: Modify a SecurityIntentBinding

• Expected Outcome:

  • The corresponding NimbusPolicy is updated.

• Scenario: Modify a NimbusPolicy

• Expected Outcome:

  • The NimbusPolicy reverts its changes.

• Similar test cases for a ClusterSecurityIntentBinding with corresponding ClusterNimbusPolicy update.

Delete

• Scenario: Delete a SecurityIntentBinding.

• Expected Outcome:

  • The corresponding NimbusPolicy is deleted.

• Similar test case for a ClusterSecurityIntentBinding with corresponding ClusterNimbusPolicy deletion.

Prevent Deploy of Containers which can evade defenses: Registration of Malicious Network Functions

DS0032: Monitor for newly constructed containers that may deploy a container into an environment to facilitate execution or evade defenses.

Below is the list of possible Kyverno policies that can achieve this intent. The intent needs to pass parameters such as allowed image repositories, allowed base images, and so on.

Please review the policies once again to ensure that there is adequate coverage for this intent.

Kyverno Policy:
Allowed Image Repositories
Allowed Base Images
Advanced Restrict Image Registries
Block Stale Images
Check Image Base
Disallow Helm Tiller
Disallow latest tag
Disallow use of the SecurityContextConstraint (SCC) anyuid
Only trustworthy registries set root
Require Image Source
Require Image pull policy always - not needed if latest tag is not used
Require image pull secrets
Require images use checksums
Restrict image registries

Suspicious IP Detection

Use turnip for suspicious IP detection

This intent is fulfilled by dev2. So, we need an adapter to interface to dev2

Intent to spawn Confidential Containers

Use cloud-api adapter and coco.

[Core]: Handle Kind mentioned in bindings selector

E2E Testing

Fix core and adapters to reconcile their policies.

When the adapter policies are updated, add functionality for the adapters to reconcile.

Kyverno Adapter: Occurs Index Out of Range

In the kyverno policy applied by default, OwnerReferences was empty, causing an index out of range error when trying to access the first element.

When trying to access kcp.OwnerReferences[0], the issue occurred because the OwnerReferences slice could be empty, but we tried to access it directly without checking.

LimitSoftwareDeployment

Techniques:

1. Radio control manipulation via rogue xApps
2. Software Deployment Tools
3. Manipulate Virtual Network Function (VNF) Configuration

ImageSignatureVerification

Techniques:

1. Supply Chain Compromise
2. Radio control manipulation via rogue xApps
3. Software Deployment Tools
4. gNodeB Component Manipulation
5. Implant Internal Image
6. Rootkit

Intent is implemented by Kyverno adapter

Network Policy Adapter - k8s netpol

Add the test cases to show that container escape is being mitigated.

Seungsoo has already done some work with Caldera. Please check with him

EnsureTLS Intent

Techniques:

1. Unauthorized access to Network Exposure Function (NEF) via token fraud
2. Radio control manipulation via rogue xApps
3. Impair Defenses
4. Network Sniffing
5. Adversary-in-the-Middle
6. Acquire Infrastructure

For power optimisation use case, add actions in the respective Adapters

More details needed here..

2. Software Deployment Tools
3. Exploit Public-Facing Application
4. Compromise Software Supply Chain
5. Standard Application Layer Protocol
6. Adversary-in-the-Middle
7. Service Based Interface
8. Transmitted Data Manipulation
9. Network Boundary Bridging
10. Weaken Encryption
11. Container Administration Command
12. Network Function Service Discovery
13. Network Flow Manipulation
14. DNS Manipulation
15. Registration of malicious network functions
16. Unauthorized access to Network Exposure Function (NEF) via token fraud
17. Exploit Semi-public Facing Application
18. gNodeB Component Manipulation
19. Radio Intelligent Controller (RIC)
20. Rogue xApps unauthorized access
21. Escape to Host

basic CI actions

• gosec, golint, goreport
• test automation
• auto release images on PR merge
• license header check

WAFExploitDetection Intent

Techniques:

1. Exploit Public-Facing Application
2. Exploit Semi Public-Facing Application

Network Segmentation: Addresses Multiple intents

Generate zero-trust policies generated by the discovery engine based on application behaviour

The attacks that can be mitigated are:

• Exploit public-facing applications
• Registration of malicious network functions
• Software Deployment Tools
• Malicious VNF installation

Techniques:

1. Radio control manipulation via rogue xApps
2. Trusted Relationship
3. Registration of malicious network functions
4. Software Deployment Tools
5. gNodeB Component Manipulation
6. Network Sniffing [Tactic: Credential Access]
7. Adversary-in-the-Middle [Tactic: Credential Access]
8. Network Sniffing [Tactic: Resource Development]
9. Adversary-in-the-Middle [Tactic: Resource Development]

Parameters need to be provided such which container is to be isolated

The adapters that are involved are:

KubeArmor, Network Policy, Service Mesh

Design doc

Nimbus external engines should be added a plugins

[Core]: Logs are getting duplicated

Description

Steps to reproduce

1. Run nimbus

make run

2. Apply a sample SI + SIB

kubectl apply -f examples/namespaced/pkg-mgr-exec-si-sib.yaml

3. See the logs

2024-02-14T22:11:14+05:30       INFO    setup   Starting manager
2024-02-14T22:11:14+05:30       INFO    starting server {"kind": "health probe", "addr": "[::]:8081"}
2024-02-14T22:11:14+05:30       INFO    controller-runtime.metrics      Starting metrics server
2024-02-14T22:11:14+05:30       INFO    controller-runtime.metrics      Serving metrics server  {"bindAddress": ":8080", "secure": false}
2024-02-14T22:11:14+05:30       INFO    Starting EventSource    {"controller": "clustersecurityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "ClusterSecurityIntentBinding", "source": "kind source: *v1.ClusterSecurityIntentBinding"}
2024-02-14T22:11:14+05:30       INFO    Starting EventSource    {"controller": "securityintent", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntent", "source": "kind source: *v1.SecurityIntent"}
2024-02-14T22:11:14+05:30       INFO    Starting Controller     {"controller": "securityintent", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntent"}
2024-02-14T22:11:14+05:30       INFO    Starting EventSource    {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "source": "kind source: *v1.SecurityIntentBinding"}
2024-02-14T22:11:14+05:30       INFO    Starting EventSource    {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "source": "kind source: *v1.NimbusPolicy"}
2024-02-14T22:11:14+05:30       INFO    Starting Controller     {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding"}
2024-02-14T22:11:14+05:30       INFO    Starting EventSource    {"controller": "clustersecurityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "ClusterSecurityIntentBinding", "source": "kind source: *v1.ClusterNimbusPolicy"}
2024-02-14T22:11:14+05:30       INFO    Starting Controller     {"controller": "clustersecurityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "ClusterSecurityIntentBinding"}
2024-02-14T22:11:14+05:30       INFO    Starting workers        {"controller": "securityintent", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntent", "worker count": 1}
2024-02-14T22:11:14+05:30       INFO    Starting workers        {"controller": "clustersecurityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "ClusterSecurityIntentBinding", "worker count": 1}
2024-02-14T22:11:14+05:30       INFO    Starting workers        {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "worker count": 1}
2024-02-14T22:11:15+05:30       INFO    SecurityIntent found    {"controller": "securityintent", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntent", "SecurityIntent": {"name":"pkg-mgr-execution"}, "namespace": "", "name": "pkg-mgr-execution", "reconcileID": "e5c1170e-db26-4e1e-a828-4f0acbf5c29f", "SecurityIntent.Name": "pkg-mgr-execution"}
2024-02-14T22:11:15+05:30       INFO    SecurityIntentBinding found     {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "a5644e7c-d8b6-45cb-9b85-1b05f1f2eb23", "SecurityIntentBinding.Name": "pkg-mgr-execution-binding", "SecurityIntentBinding.Namespace": "default"}
2024-02-14T22:11:15+05:30       INFO    SecurityIntent and SecurityIntentBinding matching started       {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "9091fe05-4b4f-49c1-94e9-d5e720315ae4"}
2024-02-14T22:11:15+05:30       INFO    Matching completed      {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "9091fe05-4b4f-49c1-94e9-d5e720315ae4", "Matched SecurityIntents": ["pkg-mgr-execution"], "Matched SecurityIntentsBindings": ["pkg-mgr-execution-binding"]}
2024-02-14T22:11:15+05:30       INFO    Building NimbusPolicy   {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "9091fe05-4b4f-49c1-94e9-d5e720315ae4"}
2024-02-14T22:11:15+05:30       INFO    NimbusPolicy built successfully {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "9091fe05-4b4f-49c1-94e9-d5e720315ae4", "Policy": {"namespace": "default", "name": "pkg-mgr-execution-binding"}}
2024-02-14T22:11:15+05:30       INFO    NimbusPolicy created    {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "9091fe05-4b4f-49c1-94e9-d5e720315ae4", "NimbusPolicy.Name": "pkg-mgr-execution-binding", "NimbusPolicy.Namespace": "default"}
2024-02-14T22:11:15+05:30       INFO    NimbusPolicy created    {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "9091fe05-4b4f-49c1-94e9-d5e720315ae4", "NimbusPolicy.Name": "pkg-mgr-execution-binding", "NimbusPolicy.Namespace": "default"}
2024-02-14T22:11:15+05:30       INFO    SecurityIntent and SecurityIntentBinding matching started       {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "a2411ff1-9788-4150-901d-bc12e45414d3"}
2024-02-14T22:11:15+05:30       INFO    Matching completed      {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "a2411ff1-9788-4150-901d-bc12e45414d3", "Matched SecurityIntents": ["pkg-mgr-execution"], "Matched SecurityIntentsBindings": ["pkg-mgr-execution-binding"]}
2024-02-14T22:11:15+05:30       INFO    Building NimbusPolicy   {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "a2411ff1-9788-4150-901d-bc12e45414d3"}
2024-02-14T22:11:15+05:30       INFO    NimbusPolicy built successfully {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "a2411ff1-9788-4150-901d-bc12e45414d3", "Policy": {"namespace": "default", "name": "pkg-mgr-execution-binding"}}
2024-02-14T22:11:15+05:30       INFO    NimbusPolicy created    {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "a2411ff1-9788-4150-901d-bc12e45414d3", "NimbusPolicy.Name": "pkg-mgr-execution-binding", "NimbusPolicy.Namespace": "default"}
2024-02-14T22:11:15+05:30       INFO    SecurityIntent and SecurityIntentBinding matching started       {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "925c98ce-5c1e-46b3-9e4d-adb41fbed826"}
2024-02-14T22:11:15+05:30       INFO    Matching completed      {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "925c98ce-5c1e-46b3-9e4d-adb41fbed826", "Matched SecurityIntents": ["pkg-mgr-execution"], "Matched SecurityIntentsBindings": ["pkg-mgr-execution-binding"]}
2024-02-14T22:11:15+05:30       INFO    Building NimbusPolicy   {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "925c98ce-5c1e-46b3-9e4d-adb41fbed826"}
2024-02-14T22:11:15+05:30       INFO    NimbusPolicy built successfully {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "925c98ce-5c1e-46b3-9e4d-adb41fbed826", "Policy": {"namespace": "default", "name": "pkg-mgr-execution-binding"}}
2024-02-14T22:11:15+05:30       INFO    NimbusPolicy created    {"controller": "securityintentbinding", "controllerGroup": "intent.security.nimbus.com", "controllerKind": "SecurityIntentBinding", "SecurityIntentBinding": {"name":"pkg-mgr-execution-binding","namespace":"default"}, "namespace": "default", "name": "pkg-mgr-execution-binding", "reconcileID": "925c98ce-5c1e-46b3-9e4d-adb41fbed826", "NimbusPolicy.Name": "pkg-mgr-execution-binding", "NimbusPolicy.Namespace": "default"}

As we can see in above logs that we're getting duplicated entries for NimbusPolicy created and then SecurityIntent and SecurityIntentBinding matching started and the same chain logs are getting duplicated.

Expected behaviour

Nimbus should not log duplicate entries.

[Core]: Handle SecurityIntent update and deletion

Currently, nimbus is not doing anything wrt changes in SecurityIntent. So we need to handle following cases:

• CREATE

  • Users should be able to create SecurityIntents or SecurityIntentBindings/ClusterSecurityIntentBinding independently.

• UPDATE

  • On update of SecurityIntent the SecurityIntentBinding or ClusterSecurityIntentBinding status subresource and NimbusPolicy or ClusterNimbusPolicy should be updated.

• DELETE

  • Same behaviour as update.

Add examples for container escape to host in the documentation

Distribution of SecurityIntents.

We need to prepare bundles of intents based on Vertical - such as ORAN

https://docs.google.com/document/d/14ospxaiiXTcyZ47aWfUt0_OW9jbqc2xQmyM17Q1zp9A/edit

There are two work items here - Frontend, Backend.

This backlog item is for the backend. Subham is working on the frontend

Golangci-lint reports several linting errors

Fix linting violations identified by golangci-lint, such as:

controllers/policy/network_policy.go:96:27: Error return value of `utils.ApplyOrUpdatePolicy` is not checked (errcheck)
        utils.ApplyOrUpdatePolicy(ctx, c, policy, policy.Name)
                                 ^
controllers/policy/network_policy.go:87:6: func `createCiliumNetworkPolicy` is unused (unused)
func createCiliumNetworkPolicy(ctx context.Context, intent *intentv1.SecurityIntent) *ciliumv2.CiliumNetworkPolicy {
     ^
controllers/policy/network_policy.go:91:6: func `createKubeArmorNetworkPolicy` is unused (unused)
func createKubeArmorNetworkPolicy(ctx context.Context, intent *intentv1.SecurityIntent) *kubearmorpolicyv1.KubeArmorPolicy {
     ^
controllers/policy/network_policy.go:95:6: func `applyCiliumNetworkPolicy` is unused (unused)
func applyCiliumNetworkPolicy(ctx context.Context, c client.Client, policy *ciliumv2.CiliumNetworkPolicy) {

Virtual Patch: Exploit Public Facing Applications

M1051 is "Update Software Regularly". Virtual Patch is an intermediate step before the actual update.

There is a set of annotations (CVEs) on the pods

Nimbus can look at the CVEs, and then attempt a live patch on these pods to mitigate the CVE

As part of live patch, Also, Nimbus can also create NetPol in case of workloads exposed to Public INternet

Design Doc for the intent: https://docs.google.com/document/d/1Eui0kRgOtWK6dxFS7OceHrRS_CoA2mktIAb0oRvSZ5s/edit#heading=h.4t592l2u5hfg

Add helm chart for nimbus-kyverno adapter

Update the security intents in the context of container escape to host

Cleanup code: Implement new CRD for Intent with ID, params

Least Permissive Access to Secrets

Mitigates these techniques

• Unauthorized access to Network Exposure Function (NEF) via token fraud
• Radio control manipulation via rogue xApps

Implemented by the KubeArmor Adapter

Vulnerability Scanning

Techniques:

1. Exploit Public-Facing Application
2. Supply Chain Compromise

Vulnerability Scanning

This is a pre-deployment requirements..

Only scanned images can be loaded..