default-validator: restrict sysctl adjustment

samuelkarp · samuelkarp · commit 914fbf3faf42 · 2025-12-01T12:25:17.000-08:00
Signed-off-by: Samuel Karp &lt;samuelkarp@google.com&gt;
diff --git a/plugins/default-validator/default-validator.go b/plugins/default-validator/default-validator.go
@@ -24,10 +24,11 @@ import (
 	"strconv"
 	"strings"
 
+	yaml "gopkg.in/yaml.v3"
+
 	"github.com/containerd/nri/pkg/api"
 	"github.com/containerd/nri/pkg/log"
 	"github.com/containerd/nri/pkg/plugin"
-	yaml "gopkg.in/yaml.v3"
 )
 
 // DefaultValidatorConfig is the configuration for the default validator plugin.
@@ -47,6 +48,8 @@ type DefaultValidatorConfig struct {
 	RejectCustomSeccompAdjustment bool `yaml:"rejectCustomSeccompAdjustment" toml:"reject_custom_seccomp_adjustment"`
 	// RejectNamespaceAdjustment fails validation if any plugin adjusts Linux namespaces.
 	RejectNamespaceAdjustment bool `yaml:"rejectNamespaceAdjustment" toml:"reject_namespace_adjustment"`
+	// RejectSysctlAdjustment fails validation if any plugin adjusts sysctls
+	RejectSysctlAdjustment bool `yaml:"rejectSysctlAdjustment" toml:"reject_sysctl_adjustment"`
 	// RequiredPlugins list globally required plugins. These must be present
 	// or otherwise validation will fail.
 	// WARNING: This is a global setting and will affect all containers. In
@@ -115,6 +118,11 @@ func (v *DefaultValidator) ValidateContainerAdjustment(ctx context.Context, req
 		return err
 	}
 
+	if err := v.validateSysctl(req); err != nil {
+		log.Errorf(ctx, "rejecting adjustment: %v", err)
+		return err
+	}
+
 	return nil
 }
 
@@ -203,6 +211,31 @@ func (v *DefaultValidator) validateNamespaces(req *api.ValidateContainerAdjustme
 		ErrValidation, offenders)
 }
 
+func (v *DefaultValidator) validateSysctl(req *api.ValidateContainerAdjustmentRequest) error {
+	if req.Adjust == nil || req.Adjust.Linux == nil {
+		return nil
+	}
+
+	if !v.cfg.RejectSysctlAdjustment {
+		return nil
+	}
+
+	var owners []string
+	for key := range req.Adjust.Linux.Sysctl {
+		owner, claimed := req.Owners.SysctlOwner(req.Container.Id, key)
+		if !claimed {
+			continue
+		}
+		owners = append(owners, owner)
+	}
+
+	if len(owners) == 0 {
+		return nil
+	}
+
+	return fmt.Errorf("%w: attempted restricted sysctl adjustment by plugin(s) %s", ErrValidation, strings.Join(owners, ", "))
+}
+
 func (v *DefaultValidator) validateRequiredPlugins(req *api.ValidateContainerAdjustmentRequest) error {
 	var (
 		container = req.GetContainer().GetName()
diff --git a/plugins/default-validator/default-validator_test.go b/plugins/default-validator/default-validator_test.go
@@ -19,11 +19,12 @@ package validator
 import (
 	"testing"
 
-	"github.com/containerd/nri/pkg/api"
 	"github.com/stretchr/testify/require"
+
+	"github.com/containerd/nri/pkg/api"
 )
 
-func TestValidateReqiredPlugins(t *testing.T) {
+func TestValidateRequiredPlugins(t *testing.T) {
 	type testCase struct {
 		name      string
 		cfg       *DefaultValidatorConfig
@@ -252,5 +253,82 @@ func TestValidateReqiredPlugins(t *testing.T) {
 			}
 		})
 	}
+}
+
+func TestValidateSysctl(t *testing.T) {
+	type testCase struct {
+		name      string
+		cfg       *DefaultValidatorConfig
+		pod       *api.PodSandbox
+		container *api.Container
+		plugins   []*api.PluginInstance
+		adjust    *api.ContainerAdjustment
+		claim     func(f *api.FieldOwners) error
+		fail      bool
+	}
+
+	for _, tc := range []*testCase{
+		{
+			name: "disallowed sysctl adjustment",
+			cfg: &DefaultValidatorConfig{
+				Enable:                 true,
+				RejectSysctlAdjustment: true,
+			},
+			pod: &api.PodSandbox{
+				Id:        "pod-id",
+				Name:      "pod-name",
+				Namespace: "pod-namespace",
+			},
+			container: &api.Container{
+				Id:   "container-id",
+				Name: "container-name",
+			},
+			plugins: []*api.PluginInstance{
+				{
+					Name:  "plugin2",
+					Index: "00",
+				},
+			},
+			adjust: &api.ContainerAdjustment{
+				Linux: &api.LinuxContainerAdjustment{
+					Sysctl: map[string]string{
+						"foo": "bar",
+					},
+				},
+			},
+			claim: func(f *api.FieldOwners) error {
+				return f.ClaimSysctl("foo", "plugin2")
+			},
+			fail: true,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			v := NewDefaultValidator(tc.cfg)
+			owners := &api.OwningPlugins{
+				Owners: make(map[string]*api.FieldOwners),
+			}
+			owners.Owners[tc.container.Id] = &api.FieldOwners{
+				Simple:   make(map[int32]string),
+				Compound: make(map[int32]*api.CompoundFieldOwners),
+			}
+			if tc.claim != nil {
+				require.NoError(t, tc.claim(owners.Owners[tc.container.Id]))
+			}
 
+			req := &api.ValidateContainerAdjustmentRequest{
+				Pod:       tc.pod,
+				Container: tc.container,
+				Plugins:   tc.plugins,
+				Adjust:    tc.adjust,
+				Owners:    owners,
+			}
+
+			err := v.validateSysctl(req)
+			if tc.fail {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
 }
