From 6f3efbc1821c9a1e41526807b4ef2d753da66842 Mon Sep 17 00:00:00 2001
From: taimurhafeez <taimurhafeez93@gmail.com>
Date: Mon, 27 Jul 2026 17:09:45 +0100
Subject: [PATCH 1/2] CMP-4438: Add manual rule
 kubevirt-restrict-vm-cluster-instance-preference-types (CIS OCP-Virt 1.13)

---
 .../rule.yml                                  | 36 +++++++++++++++++++
 .../ocp4/profiles/cis-vm-extension.profile    |  1 +
 2 files changed, 37 insertions(+)
 create mode 100644 applications/openshift-virtualization/kubevirt-restrict-vm-cluster-instance-preference-types/rule.yml

diff --git a/applications/openshift-virtualization/kubevirt-restrict-vm-cluster-instance-preference-types/rule.yml b/applications/openshift-virtualization/kubevirt-restrict-vm-cluster-instance-preference-types/rule.yml
new file mode 100644
index 00000000000..de4f4b7b20e
--- /dev/null
+++ b/applications/openshift-virtualization/kubevirt-restrict-vm-cluster-instance-preference-types/rule.yml
@@ -0,0 +1,36 @@
+documentation_complete: true
+
+title: 'Restrict Create/Modify Virtual Machine Cluster Instance and Preference Types'
+
+description: |-
+    Only authorized subjects should be allowed to create or modify
+    <tt>VirtualMachineClusterInstancetype</tt> and
+    <tt>VirtualMachineClusterPreference</tt> resources. These
+    cluster-scoped resources define hardware profiles and configuration
+    preferences that are available to all namespaces. Unrestricted
+    access allows any subject to alter the instance types and
+    preferences used when creating virtual machines, potentially
+    introducing insecure or non-compliant configurations
+    cluster-wide.
+
+rationale: |-
+    Cluster instance types and preferences govern the default hardware
+    and configuration settings applied to new virtual machines. If
+    unauthorized subjects can create or modify these resources, they
+    can introduce overly permissive settings, disable security
+    controls, or allocate excessive resources across the cluster.
+    Restricting access ensures that only approved administrators
+    define the VM profiles available to tenants.
+
+severity: medium
+
+ocil_clause: 'unauthorized subjects can create or modify cluster instance or preference types'
+
+ocil: |-
+    Run the following commands to check which subjects can create or
+    update cluster instance and preference types:
+    <pre>$ oc adm policy who-can create virtualmachineclusterinstancetypes</pre>
+    <pre>$ oc adm policy who-can update virtualmachineclusterinstancetypes</pre>
+    <pre>$ oc adm policy who-can create virtualmachineclusterpreferences</pre>
+    <pre>$ oc adm policy who-can update virtualmachineclusterpreferences</pre>
+    Verify that only authorized subjects are listed in the output.
diff --git a/products/ocp4/profiles/cis-vm-extension.profile b/products/ocp4/profiles/cis-vm-extension.profile
index 9c3e034f0bb..3b321aee630 100644
--- a/products/ocp4/profiles/cis-vm-extension.profile
+++ b/products/ocp4/profiles/cis-vm-extension.profile
@@ -34,6 +34,7 @@ selections:
     - kubevirt-sriov-vlan-required
     - kubevirt-localnet-vlan-required
     - kubevirt-sriov-spoofchk-on
+    - kubevirt-restrict-vm-cluster-instance-preference-types
     - kubevirt-bridge-mac-spoof-filtering
     - kubevirt-restrict-migration-tools-access
     - kubevirt-downward-metrics-disabled

From 26715d5b6ea86811bbdd077d75141c8dfa1bf287 Mon Sep 17 00:00:00 2001
From: taimurhafeez <taimurhafeez93@gmail.com>
Date: Thu, 6 Aug 2026 12:17:57 +0100
Subject: [PATCH 2/2] Update description with CustomRule guidance per review
 explains manual status and points organizations to CustomRules for
 automation.

Co-Authored-By: Claude Opus 4.6
---
 .../rule.yml                                     | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/applications/openshift-virtualization/kubevirt-restrict-vm-cluster-instance-preference-types/rule.yml b/applications/openshift-virtualization/kubevirt-restrict-vm-cluster-instance-preference-types/rule.yml
index de4f4b7b20e..34b24eb7f65 100644
--- a/applications/openshift-virtualization/kubevirt-restrict-vm-cluster-instance-preference-types/rule.yml
+++ b/applications/openshift-virtualization/kubevirt-restrict-vm-cluster-instance-preference-types/rule.yml
@@ -3,15 +3,13 @@ documentation_complete: true
 title: 'Restrict Create/Modify Virtual Machine Cluster Instance and Preference Types'
 
 description: |-
-    Only authorized subjects should be allowed to create or modify
-    <tt>VirtualMachineClusterInstancetype</tt> and
-    <tt>VirtualMachineClusterPreference</tt> resources. These
-    cluster-scoped resources define hardware profiles and configuration
-    preferences that are available to all namespaces. Unrestricted
-    access allows any subject to alter the instance types and
-    preferences used when creating virtual machines, potentially
-    introducing insecure or non-compliant configurations
-    cluster-wide.
+    Because the set of authorized subjects is specific to each environment,
+    this rule requires manual verification. Organizations can create a
+    CustomRule using CEL to automate this check by evaluating
+    ClusterRoleBindings and ClusterRoles for create and update access to
+    <tt>virtualmachineclusterinstancetypes</tt> and
+    <tt>virtualmachineclusterpreferences</tt> resources, verifying that
+    only approved subjects are bound to those permissions.
 
 rationale: |-
     Cluster instance types and preferences govern the default hardware