From 906889700a3eb006781c73d98a728c16c03d2c3d Mon Sep 17 00:00:00 2001 From: taimurhafeez Date: Mon, 27 Jul 2026 17:53:56 +0100 Subject: [PATCH 1/2] CMP-4440: Add manual rule kubevirt-restrict-cross-datavolume-cloning (CIS OCP-Virt 3.1) --- .../rule.yml | 35 +++++++++++++++++++ .../ocp4/profiles/cis-vm-extension.profile | 1 + 2 files changed, 36 insertions(+) create mode 100644 applications/openshift-virtualization/kubevirt-restrict-cross-datavolume-cloning/rule.yml diff --git a/applications/openshift-virtualization/kubevirt-restrict-cross-datavolume-cloning/rule.yml b/applications/openshift-virtualization/kubevirt-restrict-cross-datavolume-cloning/rule.yml new file mode 100644 index 000000000000..5ec0babc82e9 --- /dev/null +++ b/applications/openshift-virtualization/kubevirt-restrict-cross-datavolume-cloning/rule.yml @@ -0,0 +1,35 @@ +documentation_complete: true + +title: 'Restrict Access to Cross DataVolume Cloning' + +description: |- + Only authorized subjects should be granted cross-namespace + DataVolume cloning permissions. Cross-namespace cloning is + controlled by binding a datavolume-cloner-style + ClusterRole to service accounts in other namespaces. Unrestricted + cross-namespace cloning allows subjects to copy virtual machine + disk data from one namespace to another, potentially exposing + sensitive workload data to unauthorized tenants. + +rationale: |- + Cross-namespace DataVolume cloning copies disk image data between + namespaces. If the rolebindings that grant cloning permissions are + too broad, unauthorized users in destination namespaces can clone + disks containing sensitive data from source namespaces. Reviewing + and restricting these rolebindings ensures that only intended + namespaces and subjects can perform cross-namespace disk cloning + operations. + +severity: medium + +ocil_clause: 'unauthorized subjects have cross-namespace datavolume cloning access' + +ocil: |- + Run the following command to review rolebindings that grant + cross-namespace DataVolume cloning permissions in the source + namespace: + 
$ oc get rolebinding -n <source-namespace> <allow-clone-to-user> -oyaml
+ Review rolebindings binding a datavolume-cloner-style + ClusterRole to service accounts in other namespaces. Verify that + destination namespaces are intended and only authorized subjects + are bound. diff --git a/products/ocp4/profiles/cis-vm-extension.profile b/products/ocp4/profiles/cis-vm-extension.profile index 9c3e034f0bb9..41e934d9158d 100644 --- a/products/ocp4/profiles/cis-vm-extension.profile +++ b/products/ocp4/profiles/cis-vm-extension.profile @@ -39,4 +39,5 @@ selections: - kubevirt-downward-metrics-disabled - kubevirt-ksm-disabled - kubevirt-no-jsonpatch-annotations + - kubevirt-restrict-cross-datavolume-cloning - kubevirt-restrict-exec-access-to-pods From 788cc25c25af002fae13ddb1a03818f0863e3175 Mon Sep 17 00:00:00 2001 From: taimurhafeez Date: Thu, 6 Aug 2026 12:25:10 +0100 Subject: [PATCH 2/2] Update description with CustomRule guidance per review. Replace description that explains manual status and points organizations to CustomRules for automation. Co-Authored-By: Claude Opus 4.6 --- .../rule.yml | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/applications/openshift-virtualization/kubevirt-restrict-cross-datavolume-cloning/rule.yml b/applications/openshift-virtualization/kubevirt-restrict-cross-datavolume-cloning/rule.yml index 5ec0babc82e9..00fcdd668db0 100644 --- a/applications/openshift-virtualization/kubevirt-restrict-cross-datavolume-cloning/rule.yml +++ b/applications/openshift-virtualization/kubevirt-restrict-cross-datavolume-cloning/rule.yml @@ -3,13 +3,12 @@ documentation_complete: true title: 'Restrict Access to Cross DataVolume Cloning' description: |- - Only authorized subjects should be granted cross-namespace - DataVolume cloning permissions. Cross-namespace cloning is - controlled by binding a datavolume-cloner-style - ClusterRole to service accounts in other namespaces. Unrestricted - cross-namespace cloning allows subjects to copy virtual machine - disk data from one namespace to another, potentially exposing - sensitive workload data to unauthorized tenants. + Because the set of authorized subjects and namespaces is specific to each + cluster, this rule cannot be evaluated automatically and is reported as + manual. Organizations can create a CustomRule with a CEL expression that + lists RoleBindings referencing the datavolume-cloner ClusterRole + and verifies that only approved subjects and destination namespaces are + bound. rationale: |- Cross-namespace DataVolume cloning copies disk image data between