Skip to content

Commit d90ee3b

Browse files
danilrwxdanilrwx
committed
fix(audit): rename audit events (#1611)
Description Improving audit events names. Also add ignoring system service acconts. Signed-off-by: Daniil Antoshin <[email protected]>
1 parent 143c35b commit d90ee3b

File tree

16 files changed

+138
-93
lines changed

16 files changed

+138
-93
lines changed

‎images/virtualization-artifact/pkg/audit/events/forbid/forbid.go‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,11 @@ func (m *Forbid) IsMatched() bool {
6060
return false
6161
}
6262

63+
if strings.HasPrefix(m.event.User.Username, "system:") &&
64+
!strings.HasPrefix(m.event.User.Username, "system:serviceaccount:d8-service-accounts") {
65+
return false
66+
}
67+
6368
if m.event.Annotations[annotations.AnnAuditDecision] == "forbid" {
6469
return true
6570
}
@@ -82,7 +87,7 @@ func (m *Forbid) Fill() error {
8287
}
8388

8489
m.eventLog.Name = fmt.Sprintf(
85-
"User (%s) attempted to perform a forbidden operation (%s) on resource (%s).",
90+
"User '%s' attempted to perform a forbidden operation '%s' on resource '%s'.",
8691
m.event.User.Username,
8792
m.event.Verb,
8893
resource)

‎images/virtualization-artifact/pkg/audit/events/forbid/forbid_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -168,7 +168,7 @@ var _ = Describe("Forbid Events", func() {
168168
Expect(eventLog.eventLog.Type).To(Equal("Forbidden operation"))
169169
Expect(eventLog.eventLog.Level).To(Equal("warn"))
170170

171-
Expect(eventLog.eventLog.Name).To(Equal("User (test-user) attempted to perform a forbidden operation (create) on resource (pods/test/test-vmi)."))
171+
Expect(eventLog.eventLog.Name).To(Equal("User 'test-user' attempted to perform a forbidden operation 'create' on resource 'pods/test/test-vmi'."))
172172

173173
Expect(eventLog.eventLog.Datetime).To(Equal(currentTime.Format(time.RFC3339)))
174174
Expect(eventLog.eventLog.UID).To(Equal("0000-0000-0000"))

‎images/virtualization-artifact/pkg/audit/events/integrity/integrity_check_vm.go‎

Lines changed: 15 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ package integrity
1818

1919
import (
2020
"fmt"
21+
"strings"
2122

2223
"k8s.io/apiserver/pkg/apis/audit"
2324

@@ -54,6 +55,11 @@ func (m *IntegrityCheckVM) IsMatched() bool {
5455
return false
5556
}
5657

58+
if strings.HasPrefix(m.event.User.Username, "system:") &&
59+
!strings.HasPrefix(m.event.User.Username, "system:serviceaccount:d8-service-accounts") {
60+
return false
61+
}
62+
5763
if (m.event.Verb == "patch" || m.event.Verb == "update") && m.event.ObjectRef.Resource == "internalvirtualizationvirtualmachineinstances" {
5864
return true
5965
}
@@ -64,25 +70,25 @@ func (m *IntegrityCheckVM) IsMatched() bool {
6470
func (m *IntegrityCheckVM) Fill() error {
6571
m.eventLog = NewIntegrityCheckEventLog(m.event)
6672

67-
m.eventLog.Name = "VM config integrity check failed"
73+
vmi, err := util.GetInternalVMIFromInformer(m.ttlCache, m.informerList.GetInternalVMIInformer(), m.event.ObjectRef.Namespace+"/"+m.event.ObjectRef.Name)
74+
if err != nil {
75+
return fmt.Errorf("failed to get VMI from informer: %w", err)
76+
}
77+
78+
m.eventLog.Name = fmt.Sprintf("Virtual machine '%s' config integrity check failed", vmi.Name)
6879
m.eventLog.ObjectType = "Virtual machine configuration"
6980
m.eventLog.ControlMethod = "Integrity Check"
7081
m.eventLog.ReactionType = "info"
7182
m.eventLog.IntegrityCheckAlgo = "sha256"
7283

73-
vmi, err := util.GetInternalVMIFromInformer(m.ttlCache, m.informerList.GetInternalVMIInformer(), m.event.ObjectRef.Namespace+"/"+m.event.ObjectRef.Name)
74-
if err != nil {
75-
return fmt.Errorf("failed to get VMI from informer: %w", err)
76-
}
84+
m.eventLog.VirtualMachineName = vmi.Name
85+
m.eventLog.ReferenceChecksum = vmi.Annotations[annotations.AnnIntegrityCoreChecksum]
86+
m.eventLog.CurrentChecksum = vmi.Annotations[annotations.AnnIntegrityCoreChecksumApplied]
7787

7888
if vmi.Annotations[annotations.AnnIntegrityCoreChecksum] == vmi.Annotations[annotations.AnnIntegrityCoreChecksumApplied] {
7989
m.eventLog.shouldLog = false
8090
return nil
8191
}
8292

83-
m.eventLog.VirtualMachineName = vmi.Name
84-
m.eventLog.ReferenceChecksum = vmi.Annotations[annotations.AnnIntegrityCoreChecksum]
85-
m.eventLog.CurrentChecksum = vmi.Annotations[annotations.AnnIntegrityCoreChecksumApplied]
86-
8793
return nil
8894
}

‎images/virtualization-artifact/pkg/audit/events/integrity/integrity_check_vm_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -158,7 +158,7 @@ var _ = Describe("Integrity Check VM Events", func() {
158158

159159
Expect(eventLog.eventLog.Type).To(Equal("Integrity check"))
160160
Expect(eventLog.eventLog.Level).To(Equal("critical"))
161-
Expect(eventLog.eventLog.Name).To(Equal("VM config integrity check failed"))
161+
Expect(eventLog.eventLog.Name).To(Equal("Virtual machine 'test-vm' config integrity check failed"))
162162
Expect(eventLog.eventLog.Datetime).To(Equal(currentTime.Format(time.RFC3339)))
163163
Expect(eventLog.eventLog.UID).To(Equal("0000-0000-0000"))
164164
Expect(eventLog.eventLog.OperationResult).To(Equal("allow"))

‎images/virtualization-artifact/pkg/audit/events/module/module_component_control.go‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ limitations under the License.
1717
package module
1818

1919
import (
20+
"fmt"
2021
"strings"
2122

2223
"k8s.io/apiserver/pkg/apis/audit"
@@ -61,8 +62,8 @@ func (m *ModuleComponentControl) IsMatched() bool {
6162
return false
6263
}
6364

64-
// Skip control requests from internal k8s controllers because we get them with almost empty ObjectRef
65-
if strings.Contains(m.event.User.Username, kubeSystemUsername) {
65+
if strings.HasPrefix(m.event.User.Username, "system:") &&
66+
!strings.HasPrefix(m.event.User.Username, "system:serviceaccount:d8-service-accounts") {
6667
return false
6768
}
6869

@@ -84,11 +85,11 @@ func (m *ModuleComponentControl) Fill() error {
8485
m.eventLog.Type = "Virtualization control"
8586

8687
if m.event.Verb == "create" {
87-
m.eventLog.Name = "Component creation"
88+
m.eventLog.Name = fmt.Sprintf("Component '%s' has been created by '%s'", m.event.ObjectRef.Name, m.event.User.Username)
8889
m.eventLog.Level = "info"
8990
m.eventLog.Component = m.event.ObjectRef.Name
9091
} else {
91-
m.eventLog.Name = "Component deletion"
92+
m.eventLog.Name = fmt.Sprintf("Component '%s' has been deleted by '%s'", m.event.ObjectRef.Name, m.event.User.Username)
9293
m.eventLog.Level = "warn"
9394
m.eventLog.Component = m.event.ObjectRef.Name
9495
}

‎images/virtualization-artifact/pkg/audit/events/module/module_component_control_test.go‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -263,33 +263,33 @@ var _ = Describe("Module component control events", func() {
263263
}),
264264
Entry("Module Control creation event shouldn't failed fill", moduleComponentControlTestArgs{
265265
eventVerb: "create",
266-
expectedName: "Component creation",
266+
expectedName: "Component 'virt-handler' has been created by 'test-user'",
267267
expectedLevel: "info",
268268
expectedActionType: "create",
269269
}),
270270
Entry("Module Control creation event shouldn't failed fill", moduleComponentControlTestArgs{
271271
eventVerb: "delete",
272-
expectedName: "Component deletion",
272+
expectedName: "Component 'virt-handler' has been deleted by 'test-user'",
273273
expectedLevel: "warn",
274274
expectedActionType: "delete",
275275
}),
276276
Entry("Module Control creation event shouldn't failed fill with losted module", moduleComponentControlTestArgs{
277277
eventVerb: "delete",
278-
expectedName: "Component deletion",
278+
expectedName: "Component 'virt-handler' has been deleted by 'test-user'",
279279
expectedLevel: "warn",
280280
expectedActionType: "delete",
281281
shouldLostModule: true,
282282
}),
283283
Entry("Module Control creation event shouldn't failed fill with losted node", moduleComponentControlTestArgs{
284284
eventVerb: "delete",
285-
expectedName: "Component deletion",
285+
expectedName: "Component 'virt-handler' has been deleted by 'test-user'",
286286
expectedLevel: "warn",
287287
expectedActionType: "delete",
288288
shouldLostNode: true,
289289
}),
290290
Entry("Module Control creation event shouldn't failed fill with losted pod", moduleComponentControlTestArgs{
291291
eventVerb: "delete",
292-
expectedName: "Component deletion",
292+
expectedName: "Component 'virt-handler' has been deleted by 'test-user'",
293293
expectedLevel: "warn",
294294
expectedActionType: "delete",
295295
shouldLostPod: true,

‎images/virtualization-artifact/pkg/audit/events/module/module_control.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,8 @@ func (m *ModuleControl) IsMatched() bool {
5757
return false
5858
}
5959

60-
if strings.HasPrefix(m.event.User.Username, "system:serviceaccount:d8") {
60+
if strings.HasPrefix(m.event.User.Username, "system:") &&
61+
!strings.HasPrefix(m.event.User.Username, "system:serviceaccount:d8-service-accounts") {
6162
return false
6263
}
6364

‎images/virtualization-artifact/pkg/audit/events/vm/vm_access.go‎

Lines changed: 19 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ package vm
1818

1919
import (
2020
"fmt"
21+
"strings"
2122

2223
"k8s.io/apiserver/pkg/apis/audit"
2324

@@ -58,10 +59,19 @@ func (m *VMAccess) IsMatched() bool {
5859
return false
5960
}
6061

62+
if strings.HasPrefix(m.event.User.Username, "system:") &&
63+
!strings.HasPrefix(m.event.User.Username, "system:serviceaccount:d8-service-accounts") {
64+
return false
65+
}
66+
6167
if m.event.ObjectRef.Resource != "virtualmachines" || m.event.ObjectRef.APIGroup != "subresources.virtualization.deckhouse.io" {
6268
return false
6369
}
6470

71+
if m.event.Stage == audit.StageResponseStarted {
72+
return false
73+
}
74+
6575
if m.event.ObjectRef.Subresource == "console" || m.event.ObjectRef.Subresource == "vnc" || m.event.ObjectRef.Subresource == "portforward" {
6676
return true
6777
}
@@ -73,24 +83,24 @@ func (m *VMAccess) Fill() error {
7383
m.eventLog = NewVMEventLog(m.event)
7484
m.eventLog.Type = "Access to VM"
7585

76-
switch m.event.ObjectRef.Subresource {
77-
case "console":
78-
m.eventLog.Name = "Access to VM via serial console"
79-
case "vnc":
80-
m.eventLog.Name = "Access to VM via VNC"
81-
case "portforward":
82-
m.eventLog.Name = "Access to VM via portforward"
86+
stage := ""
87+
switch m.event.Stage {
88+
case audit.StageResponseComplete:
89+
stage = "finished"
90+
case audit.StageRequestReceived:
91+
stage = "initiated"
8392
}
8493

85-
m.eventLog.Name = fmt.Sprintf("%s: %s", m.eventLog.Name, m.event.Stage)
86-
94+
m.eventLog.Name = fmt.Sprintf("Virtual machine '%s' connection has been %s via %s by '%s'", m.event.ObjectRef.Name, stage, m.event.ObjectRef.Subresource, m.event.User.Username)
8795
vm, err := util.GetVMFromInformer(m.ttlCache, m.informerList.GetVMInformer(), m.event.ObjectRef.Namespace+"/"+m.event.ObjectRef.Name)
8896
if err != nil {
8997
log.Debug("fail to get vm from informer", log.Err(err))
9098

9199
return nil
92100
}
93101

102+
m.eventLog.Name = fmt.Sprintf("Virtual machine '%s' connection has been %s via %s by '%s'", vm.Name, stage, m.event.ObjectRef.Subresource, m.event.User.Username)
103+
94104
m.eventLog.QemuVersion = vm.Status.Versions.Qemu
95105
m.eventLog.LibvirtVersion = vm.Status.Versions.Libvirt
96106

‎images/virtualization-artifact/pkg/audit/events/vm/vm_access_test.go‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -252,33 +252,33 @@ var _ = Describe("VMOP Events", func() {
252252
shouldFailMatch: true,
253253
}),
254254
Entry("VM Access with ResponseComplete should contain decision and fill without errors", vmAccessTestArgs{
255-
expectedName: "Access to VM via serial console: ResponseComplete",
255+
expectedName: "Virtual machine 'test-vm' connection has been finished via console by 'test-user'",
256256
customSubresource: "console",
257257
}),
258258
Entry("VM Access with RequestReceived shouldn't contain decision and fill without errors", vmAccessTestArgs{
259-
expectedName: "Access to VM via serial console: RequestReceived",
259+
expectedName: "Virtual machine 'test-vm' connection has been initiated via console by 'test-user'",
260260
customSubresource: "console",
261261
isRequestReceived: true,
262262
}),
263263
Entry("VM Access by Console event should filled without errors", vmAccessTestArgs{
264-
expectedName: "Access to VM via serial console: ResponseComplete",
264+
expectedName: "Virtual machine 'test-vm' connection has been finished via console by 'test-user'",
265265
customSubresource: "console",
266266
}),
267267
Entry("VM Access by VNC event should filled without errors", vmAccessTestArgs{
268-
expectedName: "Access to VM via VNC: ResponseComplete",
268+
expectedName: "Virtual machine 'test-vm' connection has been finished via vnc by 'test-user'",
269269
customSubresource: "vnc",
270270
}),
271271
Entry("VM Access by Portforward event should filled without errors", vmAccessTestArgs{
272-
expectedName: "Access to VM via portforward: ResponseComplete",
272+
expectedName: "Virtual machine 'test-vm' connection has been finished via portforward by 'test-user'",
273273
customSubresource: "portforward",
274274
}),
275275
Entry("VM Access with losted VM event should filled without errors", vmAccessTestArgs{
276-
expectedName: "Access to VM via serial console: ResponseComplete",
276+
expectedName: "Virtual machine 'virt-launcher-test-vm' connection has been finished via console by 'test-user'",
277277
customSubresource: "console",
278278
shouldLostVM: true,
279279
}),
280280
Entry("VM Access with losted VD and Node event should filled without errors", vmAccessTestArgs{
281-
expectedName: "Access to VM via serial console: ResponseComplete",
281+
expectedName: "Virtual machine 'test-vm' connection has been finished via console by 'test-user'",
282282
customSubresource: "console",
283283
shouldLostVD: true,
284284
shouldLostNode: true,

‎images/virtualization-artifact/pkg/audit/events/vm/vm_control.go‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,7 @@ func (m *VMControl) Fill() error {
7979
}
8080
}
8181

82+
vmName := pod.Labels["vm.kubevirt.internal.virtualization.deckhouse.io/name"]
8283
isControllerAction := strings.HasPrefix(m.event.User.Username, "system:serviceaccount:d8-virtualization")
8384
isNodeAction := strings.HasPrefix(m.event.User.Username, "system:node")
8485

@@ -88,22 +89,22 @@ func (m *VMControl) Fill() error {
8889

8990
switch {
9091
case strings.Contains(terminatedStatuses, "guest-shutdown"):
91-
m.eventLog.Name = "VM stoped from OS"
92+
m.eventLog.Name = fmt.Sprintf("Virtual machine '%s' has been stopped from OS", vmName)
9293
case strings.Contains(terminatedStatuses, "guest-reset"):
93-
m.eventLog.Name = "VM restarted from OS"
94+
m.eventLog.Name = fmt.Sprintf("Virtual machine '%s' has been restarted from OS", vmName)
9495
default:
95-
m.eventLog.Name = "VM stopped by system"
96+
m.eventLog.shouldLog = false
9697
return nil
9798
}
9899
case isNodeAction:
99-
m.eventLog.Name = "VM stopped by system"
100+
m.eventLog.shouldLog = false
100101
return nil
101102
default:
102103
m.eventLog.Level = "critical"
103-
m.eventLog.Name = "VM killed abnormal way"
104+
m.eventLog.Name = fmt.Sprintf("Virtual machine '%s' has been killed abnormal way by '%s'", vmName, m.event.User.Username)
104105
}
105106

106-
vm, err := util.GetVMFromInformer(m.ttlCache, m.informerList.GetVMInformer(), pod.Namespace+"/"+pod.Labels["vm.kubevirt.internal.virtualization.deckhouse.io/name"])
107+
vm, err := util.GetVMFromInformer(m.ttlCache, m.informerList.GetVMInformer(), pod.Namespace+"/"+vmName)
107108
if err != nil {
108109
log.Debug("fail to get vm from informer", log.Err(err))
109110
return nil

0 commit comments

Comments
 (0)