From 5b84184efd9f5a3f87c820ab28927b6dc87b5e78 Mon Sep 17 00:00:00 2001 From: taimurhafeez Date: Mon, 27 Jul 2026 17:53:56 +0100 Subject: [PATCH 1/2] CMP-4440: Add manual rule kubevirt-restrict-cross-datavolume-cloning (CIS OCP-Virt 3.1) --- .../rule.yml | 35 +++++++++++++++++++ build-scripts/build_cel_content.py | 6 ++-- docs/manual/developer/13_cel_content.md | 12 +++---- .../ocp4/profiles/cis-vm-extension.profile | 1 + 4 files changed, 46 insertions(+), 8 deletions(-) create mode 100644 applications/openshift-virtualization/kubevirt-restrict-cross-datavolume-cloning/rule.yml diff --git a/applications/openshift-virtualization/kubevirt-restrict-cross-datavolume-cloning/rule.yml b/applications/openshift-virtualization/kubevirt-restrict-cross-datavolume-cloning/rule.yml new file mode 100644 index 000000000000..5ec0babc82e9 --- /dev/null +++ b/applications/openshift-virtualization/kubevirt-restrict-cross-datavolume-cloning/rule.yml @@ -0,0 +1,35 @@ +documentation_complete: true + +title: 'Restrict Access to Cross DataVolume Cloning' + +description: |- + Only authorized subjects should be granted cross-namespace + DataVolume cloning permissions. Cross-namespace cloning is + controlled by binding a datavolume-cloner-style + ClusterRole to service accounts in other namespaces. Unrestricted + cross-namespace cloning allows subjects to copy virtual machine + disk data from one namespace to another, potentially exposing + sensitive workload data to unauthorized tenants. + +rationale: |- + Cross-namespace DataVolume cloning copies disk image data between + namespaces. If the rolebindings that grant cloning permissions are + too broad, unauthorized users in destination namespaces can clone + disks containing sensitive data from source namespaces. Reviewing + and restricting these rolebindings ensures that only intended + namespaces and subjects can perform cross-namespace disk cloning + operations. + +severity: medium + +ocil_clause: 'unauthorized subjects have cross-namespace datavolume cloning access' + +ocil: |- + Run the following command to review rolebindings that grant + cross-namespace DataVolume cloning permissions in the source + namespace: + 
$ oc get rolebinding -n <source-namespace> <allow-clone-to-user> -oyaml
+ Review rolebindings binding a datavolume-cloner-style + ClusterRole to service accounts in other namespaces. Verify that + destination namespaces are intended and only authorized subjects + are bound. diff --git a/build-scripts/build_cel_content.py b/build-scripts/build_cel_content.py index 74786b6b9185..c58f3820bc51 100755 --- a/build-scripts/build_cel_content.py +++ b/build-scripts/build_cel_content.py @@ -339,8 +339,10 @@ def generate_cel_content(cel_rules, profiles): for rule_id in profile.selected: if rule_id not in cel_rule_ids: rule_name = rule_id_to_name(rule_id) - raise ValueError( - f"profile '{profile_name}' references unknown rule '{rule_name}'" + logging.warning( + "profile '%s' references rule '%s' without CEL checks " + "(manual rule) - skipping from CEL content", + profile_name, rule_name, ) cel_profile = profile_to_cel_dict(profile, cel_rule_ids) diff --git a/docs/manual/developer/13_cel_content.md b/docs/manual/developer/13_cel_content.md index 91cbddf9c15d..3724857dd9e1 100644 --- a/docs/manual/developer/13_cel_content.md +++ b/docs/manual/developer/13_cel_content.md @@ -141,7 +141,7 @@ selections: - kubevirt-persistent-reservation-disabled ``` -**Important:** CEL profiles can only select CEL rules. If a profile includes both CEL and OVAL rules, only the CEL rules will be included in the generated CEL content file. +**Important:** CEL profiles can select both CEL rules and manual rules (rules without `cel/shared.yml`). Manual rules are skipped during CEL content generation with a warning — only CEL rules are included in the generated CEL content file. ## Creating a CEL Rule @@ -347,8 +347,8 @@ The build system validates CEL content automatically: **Profile Validation:** - `selected` field must contain at least one rule -- All selected rules must exist in CEL rules -- Profile cannot reference OVAL rules +- Rules without CEL checks (manual rules) are skipped with a warning during CEL content generation +- No error is raised for manual rules referenced by CEL profiles **Content Validation:** - No duplicate rule names (after underscore-to-hyphen conversion) @@ -434,9 +434,9 @@ cel-spec '{"resource": {"spec": {"enabled": true}}}' 'resource.spec.enabled == t **Error: `CEL profile 'profile-name' has no rules`** - Add rules to the `selections` field in the profile -**Error: `profile 'profile-name' references unknown rule 'rule-name'`** -- Verify the rule exists and has CEL checks (has `cel/shared.yml` with `expression` and `inputs`) -- Check the rule ID matches the profile selection +**Warning: `profile 'profile-name' references rule 'rule-name' without CEL checks (manual rule)`** +- This is expected for manual rules without `cel/shared.yml` — they are skipped from CEL content +- If the rule should have CEL checks, add `cel/shared.yml` with `expression` and `inputs` ### CEL Content Not Generated diff --git a/products/ocp4/profiles/cis-vm-extension.profile b/products/ocp4/profiles/cis-vm-extension.profile index a988efb13ced..bdde6520cca0 100644 --- a/products/ocp4/profiles/cis-vm-extension.profile +++ b/products/ocp4/profiles/cis-vm-extension.profile @@ -31,3 +31,4 @@ selections: - kubevirt-no-vm-device-passthrough - kubevirt-no-shareable-disks - kubevirt-disk-error-policy-not-ignore + - kubevirt-restrict-cross-datavolume-cloning From 277011f0dca5d67e13efbcfaaeb0b40ff8ab7b06 Mon Sep 17 00:00:00 2001 From: taimurhafeez Date: Thu, 6 Aug 2026 12:25:10 +0100 Subject: [PATCH 2/2] Update description with CustomRule guidance per review. Replace description that explains manual status and points organizations to CustomRules for automation. Co-Authored-By: Claude Opus 4.6 --- .../rule.yml | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/applications/openshift-virtualization/kubevirt-restrict-cross-datavolume-cloning/rule.yml b/applications/openshift-virtualization/kubevirt-restrict-cross-datavolume-cloning/rule.yml index 5ec0babc82e9..00fcdd668db0 100644 --- a/applications/openshift-virtualization/kubevirt-restrict-cross-datavolume-cloning/rule.yml +++ b/applications/openshift-virtualization/kubevirt-restrict-cross-datavolume-cloning/rule.yml @@ -3,13 +3,12 @@ documentation_complete: true title: 'Restrict Access to Cross DataVolume Cloning' description: |- - Only authorized subjects should be granted cross-namespace - DataVolume cloning permissions. Cross-namespace cloning is - controlled by binding a datavolume-cloner-style - ClusterRole to service accounts in other namespaces. Unrestricted - cross-namespace cloning allows subjects to copy virtual machine - disk data from one namespace to another, potentially exposing - sensitive workload data to unauthorized tenants. + Because the set of authorized subjects and namespaces is specific to each + cluster, this rule cannot be evaluated automatically and is reported as + manual. Organizations can create a CustomRule with a CEL expression that + lists RoleBindings referencing the datavolume-cloner ClusterRole + and verifies that only approved subjects and destination namespaces are + bound. rationale: |- Cross-namespace DataVolume cloning copies disk image data between