mirror of
https://github.com/HackTricks-wiki/hacktricks-cloud.git
synced 2025-12-12 15:50:19 -08:00
84 lines
2.8 KiB
Markdown
84 lines
2.8 KiB
Markdown
---
|
|
description: >-
|
|
This page shows a privilege escalation scenario given that tekton is installed
|
|
in the cluster and that you can create a namespace (sometimes edit rights are
|
|
enough)
|
|
---
|
|
|
|
# OpenShift - Tekton
|
|
|
|
**The original author of this page is** [**Haroun**](https://www.linkedin.com/in/haroun-al-mounayar-571830211)
|
|
|
|
### What is tekton
|
|
|
|
According to the doc: _Tekton is a powerful and flexible open-source framework for creating CI/CD systems, allowing developers to build, test, and deploy across cloud providers and on-premise systems._ Both Jenkins and Tekton can be used to test, build and deploy applications, however Tekton is Cloud Native. 
|
|
|
|
With Tekton everything is represented by YAML files. Developers can create Custom Resources (CR) of type `Pipelines` and specify multiple `Tasks` in them that they want to run. To run a Pipeline resources of type `PipelineRun` must be created.
|
|
|
|
When tekton is installed a service account (sa) called pipeline is created in every namespace. When a Pipeline is ran, a pod will be spawned using this sa called `pipeline` to run the tasks defined in the YAML file.
|
|
|
|
{% embed url="https://tekton.dev/docs/getting-started/pipelines/" %}
|
|
Tekton Doc about Pipelines
|
|
{% endembed %}
|
|
|
|
### The Pipeline service account capabilities
|
|
|
|
By default, the pipeline service account can use the `pipelines-scc` capability. This is due to the global default configuration of tekton. Actually, the global config of tekton is also a YAML in an openshift object called `TektonConfig` that can be seen if you have some reader roles in the cluster.
|
|
|
|
```yaml
|
|
apiVersion: operator.tekton.dev/v1alpha1
|
|
kind: TektonConfig
|
|
metadata:
|
|
name: config
|
|
spec:
|
|
...
|
|
...
|
|
platforms:
|
|
openshift:
|
|
scc:
|
|
default: "pipelines-scc"
|
|
```
|
|
|
|
In any namespace, if you can get the pipeline service account token you will be able to use `pipelines-scc`.
|
|
|
|
### The Misconfig
|
|
|
|
The problem is that the default scc that the pipeline sa can use is user controllable. This can be done using a label in the namespace definition. For instance, if I can create a namespace with the following yaml definition:
|
|
|
|
```yaml
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: test-namespace
|
|
annotations:
|
|
operator.tekton.dev/scc: privileged
|
|
```
|
|
|
|
The tekton operator will give to the pipeline service account in `test-namespace` the ability to use the scc privileged. This will allow the mounting of the node.
|
|
|
|
### The fix
|
|
|
|
Tekton documents about how to restrict the override of scc by adding a label in the `TektonConfig` object.
|
|
|
|
{% embed url="https://tekton.dev/docs/operator/sccconfig/" %}
|
|
Tekton doc about scc
|
|
{% endembed %}
|
|
|
|
This label is called `max-allowed` 
|
|
|
|
```yaml
|
|
apiVersion: operator.tekton.dev/v1alpha1
|
|
kind: TektonConfig
|
|
metadata:
|
|
name: config
|
|
spec:
|
|
...
|
|
...
|
|
platforms:
|
|
openshift:
|
|
scc:
|
|
default: "restricted-v2"
|
|
maxAllowed: "privileged"
|
|
```
|
|
|