From 5655940a08a5c17be19a907acf6449c9cbb25e20 Mon Sep 17 00:00:00 2001 From: taimurhafeez Date: Mon, 27 Jul 2026 15:51:00 +0100 Subject: [PATCH 1/2] CMP-4437: Add manual rule kubevirt-restrict-vnc-access-to-workloads (CIS OCP-Virt 1.12) --- .../rule.yml | 32 +++++++++++++++++++ .../ocp4/profiles/cis-vm-extension.profile | 1 + 2 files changed, 33 insertions(+) create mode 100644 applications/openshift-virtualization/kubevirt-restrict-vnc-access-to-workloads/rule.yml diff --git a/applications/openshift-virtualization/kubevirt-restrict-vnc-access-to-workloads/rule.yml b/applications/openshift-virtualization/kubevirt-restrict-vnc-access-to-workloads/rule.yml new file mode 100644 index 000000000000..b2429e30b0c2 --- /dev/null +++ b/applications/openshift-virtualization/kubevirt-restrict-vnc-access-to-workloads/rule.yml @@ -0,0 +1,32 @@ +documentation_complete: true + +title: 'Restrict VNC Access to Cluster Workloads' + +description: |- + Only authorized subjects should be granted roles that allow VNC + access to virtual machines. VNC access is controlled through + Kubernetes RBAC by binding the token.kubevirt.io:generate + role. Unrestricted VNC access allows any bound subject to open a + graphical console session to running virtual machines, potentially + exposing sensitive workload data and enabling unauthorized + interaction with the guest operating system. + +rationale: |- + VNC provides direct graphical console access to a running virtual + machine. In an OpenShift Virtualization environment, this access is + gated by the token.kubevirt.io:generate role. If this role + is bound too broadly, unauthorized users can view and interact with + VM desktops, capture screen contents, and input commands. Restricting + VNC access through careful role binding review ensures that only + approved subjects can establish console sessions to cluster + workloads. + +severity: medium + +ocil_clause: 'unauthorized subjects have VNC access to cluster workloads' + +ocil: |- + Run the following command to list role bindings that grant VNC access: + 
$ oc get rolebinding -ojson | jq -c '.items[] | select(.roleRef.name | contains("token.kubevirt.io:generate"))'
+ Verify that only authorized subjects are bound to the + token.kubevirt.io:generate role. diff --git a/products/ocp4/profiles/cis-vm-extension.profile b/products/ocp4/profiles/cis-vm-extension.profile index 9c3e034f0bb9..f3c2728310bf 100644 --- a/products/ocp4/profiles/cis-vm-extension.profile +++ b/products/ocp4/profiles/cis-vm-extension.profile @@ -28,6 +28,7 @@ selections: - kubevirt-persistent-reservation-disabled - kubevirt-no-vms-overcommitting-guest-memory - kubevirt-enforce-trusted-tls-registries + - kubevirt-restrict-vnc-access-to-workloads - kubevirt-no-vm-device-passthrough - kubevirt-no-shareable-disks - kubevirt-disk-error-policy-not-ignore From aed9a6bdd25b9273a5135dd334cb601c3282773a Mon Sep 17 00:00:00 2001 From: taimurhafeez Date: Thu, 6 Aug 2026 12:14:07 +0100 Subject: [PATCH 2/2] Update description with CustomRule guidance per review explains manual status and points organizations to CustomRules for automation. Co-Authored-By: Claude Opus 4.6 --- .../rule.yml | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/applications/openshift-virtualization/kubevirt-restrict-vnc-access-to-workloads/rule.yml b/applications/openshift-virtualization/kubevirt-restrict-vnc-access-to-workloads/rule.yml index b2429e30b0c2..da5da129467d 100644 --- a/applications/openshift-virtualization/kubevirt-restrict-vnc-access-to-workloads/rule.yml +++ b/applications/openshift-virtualization/kubevirt-restrict-vnc-access-to-workloads/rule.yml @@ -3,13 +3,11 @@ documentation_complete: true title: 'Restrict VNC Access to Cluster Workloads' description: |- - Only authorized subjects should be granted roles that allow VNC - access to virtual machines. VNC access is controlled through - Kubernetes RBAC by binding the token.kubevirt.io:generate - role. Unrestricted VNC access allows any bound subject to open a - graphical console session to running virtual machines, potentially - exposing sensitive workload data and enabling unauthorized - interaction with the guest operating system. + Because the set of authorized subjects is specific to each + organization, this rule requires manual review. Organizations can + create a CustomRule using CEL to automate this check by querying + RoleBinding resources and verifying that only approved subjects + are bound to the token.kubevirt.io:generate role. rationale: |- VNC provides direct graphical console access to a running virtual