From a2e60a744c400967a9922b3943c74984a5888a43 Mon Sep 17 00:00:00 2001 From: taimurhafeez Date: Mon, 27 Jul 2026 12:07:23 +0100 Subject: [PATCH 1/2] CMP-4436: Add manual rule kubevirt-restrict-exec-access-to-pods (CIS OCP-Virt 1.11) --- .../rule.yml | 30 +++++++++++++++++++ .../ocp4/profiles/cis-vm-extension.profile | 1 + 2 files changed, 31 insertions(+) create mode 100644 applications/openshift-virtualization/kubevirt-restrict-exec-access-to-pods/rule.yml diff --git a/applications/openshift-virtualization/kubevirt-restrict-exec-access-to-pods/rule.yml b/applications/openshift-virtualization/kubevirt-restrict-exec-access-to-pods/rule.yml new file mode 100644 index 000000000000..b95f0b5ff391 --- /dev/null +++ b/applications/openshift-virtualization/kubevirt-restrict-exec-access-to-pods/rule.yml @@ -0,0 +1,30 @@ +documentation_complete: true + +title: 'Restrict Exec Access to Pods' + +description: |- + Only authorized subjects should be allowed to exec into pods. + The oc exec command opens a shell or runs a command inside + a running container, which provides direct access to the workload + environment. Unrestricted exec access allows any namespace user to + interact with running virtual machine pods, potentially modifying + runtime state, accessing sensitive data, or disrupting workloads. + +rationale: |- + Exec access to pods provides an interactive channel into the + container runtime environment. In an OpenShift Virtualization + context, this means direct access to the processes backing a + running virtual machine. Granting this capability to unauthorized + subjects increases the risk of data exfiltration, workload + tampering, and privilege escalation. Restricting exec access + ensures that only approved administrators can interact with + running pods. + +severity: medium + +ocil_clause: 'unauthorized subjects can exec into pods' + +ocil: |- + Run the following command to check which subjects can exec into pods: + 
$ oc adm policy who-can exec pod
+ Verify that only authorized subjects are listed in the output. diff --git a/products/ocp4/profiles/cis-vm-extension.profile b/products/ocp4/profiles/cis-vm-extension.profile index 4c314d6efb45..9c3e034f0bb9 100644 --- a/products/ocp4/profiles/cis-vm-extension.profile +++ b/products/ocp4/profiles/cis-vm-extension.profile @@ -39,3 +39,4 @@ selections: - kubevirt-downward-metrics-disabled - kubevirt-ksm-disabled - kubevirt-no-jsonpatch-annotations + - kubevirt-restrict-exec-access-to-pods From 6c2bc20d2a4c4530c01575319671256eca4144db Mon Sep 17 00:00:00 2001 From: taimurhafeez Date: Thu, 6 Aug 2026 11:49:04 +0100 Subject: [PATCH 2/2] Update description with CustomRule guidance per review- status and points organizations to CustomRules for automation. Co-Authored-By: Claude Opus 4.6 (1M context) --- .../kubevirt-restrict-exec-access-to-pods/rule.yml | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/applications/openshift-virtualization/kubevirt-restrict-exec-access-to-pods/rule.yml b/applications/openshift-virtualization/kubevirt-restrict-exec-access-to-pods/rule.yml index b95f0b5ff391..1f95eb27f512 100644 --- a/applications/openshift-virtualization/kubevirt-restrict-exec-access-to-pods/rule.yml +++ b/applications/openshift-virtualization/kubevirt-restrict-exec-access-to-pods/rule.yml @@ -3,12 +3,11 @@ documentation_complete: true title: 'Restrict Exec Access to Pods' description: |- - Only authorized subjects should be allowed to exec into pods. - The oc exec command opens a shell or runs a command inside - a running container, which provides direct access to the workload - environment. Unrestricted exec access allows any namespace user to - interact with running virtual machine pods, potentially modifying - runtime state, accessing sensitive data, or disrupting workloads. + Because the set of authorized subjects varies by organization, this rule + requires manual verification. Consider creating a CustomRule with a CEL + expression that inspects ClusterRoleBindings and RoleBindings for subjects + granted the pods/exec permission, asserting that only your + approved administrators appear in the results. rationale: |- Exec access to pods provides an interactive channel into the