General description

The plugin checks the containerization policy settings on the node.

The check is based on the following parameters:

file policy.json settings of transports and access policies to registrars:

User Control Parameter | Metric Weight
-----------------------------------------------------------------------------------------------------------------------------|-------------
having `defaultPolicy != reject`, but not included in the `podman_dev` group                                                 | 102
not having `registry.local` in the list of registrars for which the presence of an electronic signature of images is checked | 103
having registrars in the policy for which the presence of an electronic signature of images is not checked                   | 104
having transports other than `docker` in the list of supported ones (transport for receiving images from the registrar)      | 105

files for binding registrars to servers storing electronic signatures (default binding file default.yaml and registrar binding files *.yaml of the registries.d directory). Availability (number) of users:

User Control Parameter                                                                    | Metric Weight
------------------------------------------------------------------------------------------|-------------
not using signature store `http://sigstore.local:81/sigstore/` as default signature store | 106

○

user group control

presence of users with images, but not included in the podman group:

User control parameter | Metric weight
----------------------------------------------------------------------|-------------
presence of users with images, but not included in the `podman` group | 101

* presence of users of the `podman` group (excluding those in the `podman_dev` group):

User control parameter | Metric weight
-----------------------------------------------------------------------------|-------------
in the `wheel` group                                                         | 107
having the `.config/containers/` directory open for writing and modification | 90 * `share_of_offenders`
not having the `.config/containers/storage.conf` configuration file          | 90 * `share_of_offenders

share_of_violators is calculated as: number_of_violators / number_of_users_in_podman_group

All metric weights are summed up and a final metric is formed.

System logs

For system logs, the danger level is determined for each message. The danger level intervals specified by the parameters are viewed in order from highest to lowest. The message level is determined by the first match found (remember that the trigger is triggered when the metric is OUTSIDE the interval). If no match is found, the message is not output to the system log.

Based on the level found, the priority of the message and its tag (prefix) are determined. A message with the specified priority and tag is sent to the system log using the logger command:

# logger -p priority -t tag "tag: message"

In addition to the main message for icigna, the following are generated:

○

a list of offending users;

○

shortened messages for detail level 1.

icigna logs

The formats of messages and exit codes of the plugin are described in Plugin Output for Nagios https://nagios-plugins.org/doc/guidelines.html#PLUGOUTPUT.

The severity level for icigna logs is determined by the TOTAL metric. The total metric is determined to determine the level and compared with the intervals specified by the flags

○

-c - Critical

○

-w - Warning

If no match is found, icigna prints the message:

POLICY OK: Containerization policies are not violated

The program exit code (which is processed on the icigna server side) is 0.

The log format for icigna depends on the level of detail specified by the -v[vv] flag (see Verbose Output https://nagios-plugins.org/doc/guidelines.html#AEN41):

Flag | Level
-----|--------
none | 0
-v   | 1
-vv  | 2
-vvv | 3
...  | 3

For all levels, a prefix message of the following format is generated:

POLICY $prefix:

Where prefix takes the following values ​​depending on the severity level:

○

-c - Critical

○

-w - Warning

If the level of detail is 0, a shortened message is output.

POLICY $prefix: Violation of user containerization policies users

Where users is a list of users for whom violations were detected.

If the detail level is 1, then the first detail level from the list of shortened messages generated during the formation of system logs is added to the message with the prefix There are users:.

POLICY $prefix: Violation of user containerization policies $users | There are users:
shortened message
...

If the detail level is 2, then the second detail level from the list of full messages generated during the formation of system logs is added to the message.

POLICY $prefix: Violation of user containerization policies $users | There are users:
shortened message
...
shortened message |
full message
...

After displaying messages, the plugin exits with the exit code:

○

Critical - 2

○

Warning - 1

Starting a service via systemd/Timers

In addition to starting the script via nagios, the script can be started via systemd/Timers. The package includes the systemd files podsec-inotify-check-policy.service, podsec-inotify-check-policy.timer. The service file podsec-inotify-check-policy.service describes a line in the ExecStart parameter describing the startup mode of the podsec-inotify-check-policy script. The script is started with the flags -vvv -c 100 - display detailed information, all messages have the c level - critical. If incorrect policy settings are detected during the script´s operation, they are output to the system log and sent by mail to the system administrator (root).

The schedule for starting the service podsec-inotify-check-policy.service is described in the OnCalendar parameter of the schedule file podsec-inotify-check-policy.timer. The service is called every hour.

By default, the service start timer is disabled. To enable it, enter the command:

# systemctl enable --now podsec-inotify-check-policy.timer

If you need to change the script startup mode, edit the OnCalendar parameter of the schedule file podsec-inotify-check-policy.timer.