Expand run-as-non-root template to verify runAsGroup field is nonzero.

docs/generated/checks.md

@@ -528,9 +528,9 @@ key: owner
 
 **Description**: Indicates when containers are not set to runAsNonRoot.
 
-**Remediation**: Set runAsUser to a non-zero number and runAsNonRoot to true in your pod or container securityContext. Refer to https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ for details.
+**Remediation**: Set runAsUser and runAsGroup to a non-zero number and runAsNonRoot to true in your pod or container securityContext. Refer to https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ for details.
 
-**Template**: [run-as-non-root](templates.md#run-as-non-root-user)
+**Template**: [run-as-non-root](templates.md#run-as-non-root)
 ## scc-deny-privileged-container
 
 **Enabled by default**: No

docs/generated/templates.md

@@ -703,11 +703,11 @@ KubeLinter supports the following templates:
   type: string
 ```
 
-## Run as non-root user
+## Run as non-root
 
 **Key**: `run-as-non-root`
 
-**Description**: Flag containers set to run as a root user
+**Description**: Flag containers set to run as a root user or group
 
 **Supported Objects**: DeploymentLike
 

e2etests/bats-tests.sh

@@ -781,11 +781,15 @@ get_value_from() {
 
   message1=$(get_value_from "${lines[0]}" '.Reports[0].Object.K8sObject.GroupVersionKind.Kind + ": " + .Reports[0].Diagnostic.Message')
   message2=$(get_value_from "${lines[0]}" '.Reports[1].Object.K8sObject.GroupVersionKind.Kind + ": " + .Reports[1].Diagnostic.Message')
+  message3=$(get_value_from "${lines[0]}" '.Reports[2].Object.K8sObject.GroupVersionKind.Kind + ": " + .Reports[2].Diagnostic.Message')
+  message4=$(get_value_from "${lines[0]}" '.Reports[3].Object.K8sObject.GroupVersionKind.Kind + ": " + .Reports[3].Diagnostic.Message')
   count=$(get_value_from "${lines[0]}" '.Reports | length')
 
-  [[ "${message1}" == "Deployment: container \"app\" is not set to runAsNonRoot" ]]
-  [[ "${message2}" == "DeploymentConfig: container \"app2\" is not set to runAsNonRoot" ]]
-  [[ "${count}" == "2" ]]
+  [[ "${message1}" == "Deployment: container \"app\" has runAsGroup set to 0" ]]
+  [[ "${message2}" == "Deployment: container \"app\" is not set to runAsNonRoot" ]]
+  [[ "${message3}" == "DeploymentConfig: container \"app2\" has runAsGroup set to 0" ]]
+  [[ "${message4}" == "DeploymentConfig: container \"app2\" is not set to runAsNonRoot" ]]
+  [[ "${count}" == "4" ]]
 }
 
 @test "scc-deny-privileged-container" {

pkg/builtinchecks/yamls/run-as-non-root.yaml

@@ -1,7 +1,7 @@
 name: "run-as-non-root"
 description: "Indicates when containers are not set to runAsNonRoot."
 remediation: >-
-  Set runAsUser to a non-zero number and runAsNonRoot to true in your pod or container securityContext.
+  Set runAsUser and runAsGroup to a non-zero number and runAsNonRoot to true in your pod or container securityContext.
   Refer to https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ for details.
 scope:
   objectKinds:

pkg/templates/runasnonroot/template.go

@@ -34,11 +34,21 @@
 	return nil
 }
 
+func effectiveRunAsGroup(podSC *v1.PodSecurityContext, containerSC *v1.SecurityContext) *int64 {
+	if containerSC != nil && containerSC.RunAsGroup != nil {
+		return containerSC.RunAsGroup
+	}
+	if podSC != nil {
+		return podSC.RunAsGroup
+	}
+	return nil
+}
+
 func init() {
 	templates.Register(check.Template{
-		HumanName:   "Run as non-root user",
+		HumanName:   "Run as non-root",
 		Key:         "run-as-non-root",
-		Description: "Flag containers set to run as a root user",
+		Description: "Flag containers set to run as a root user or group",
 		SupportedObjectKinds: config.ObjectKindsDesc{
 			ObjectKinds: []string{objectkinds.DeploymentLike},
 		},
@@ -53,10 +63,25 @@
 				var results []diagnostic.Diagnostic
 				for _, container := range podSpec.AllContainers() {
 					runAsUser := effectiveRunAsUser(podSpec.SecurityContext, container.SecurityContext)
-					// runAsUser explicitly set to non-root. All good.
-					if runAsUser != nil && *runAsUser > 0 {
+					runAsGroup := effectiveRunAsGroup(podSpec.SecurityContext, container.SecurityContext)
+					// runAsUser and runAsGroup explicitly set to non-root. All good.
+					if (runAsUser != nil && *runAsUser > 0) && (runAsGroup != nil && *runAsGroup > 0) {
 						continue
 					}
+
+					// runAsGroup set to 0
+					if runAsGroup != nil && *runAsGroup == 0 {
+						results = append(results, diagnostic.Diagnostic{
+							Message: fmt.Sprintf("container %q has runAsGroup set to %d", container.Name, *runAsGroup),
+						})
+					}
+					// runAsGroup is not set.
+					if runAsGroup == nil {
+						results = append(results, diagnostic.Diagnostic{
+							Message: fmt.Sprintf("container %q does not have runAsGroup set", container.Name),
+						})
+					}
+
 					runAsNonRoot := effectiveRunAsNonRoot(podSpec.SecurityContext, container.SecurityContext)
 					if runAsNonRoot {
 						// runAsNonRoot set, but runAsUser set to 0. This will result in a runtime failure.

tests/checks/run-as-non-root.yml

@@ -11,8 +11,9 @@ spec:
     spec:
       containers:
         - name: app
-          runAsUser: 1001
           securityContext:
+            runAsUser: 1001
+            runAsGroup: 1001
             runAsNonRoot: true
 ---
 apiVersion: apps.openshift.io/v1
@@ -26,8 +27,9 @@ spec:
     spec:
       containers:
         - name: app2
-          runAsUser: 1001
           securityContext:
+            runAsUser: 1001
+            runAsGroup: 1001
             runAsNonRoot: true
 ---
 apiVersion: apps/v1
@@ -42,7 +44,9 @@ spec:
     spec:
       containers:
         - name: app
-          runAsUser: 0
+          securityContext:
+            runAsUser: 0
+            runAsGroup: 0
 ---
 apiVersion: apps.openshift.io/v1
 kind: DeploymentConfig
@@ -55,4 +59,6 @@ spec:
     spec:
       containers:
       - name: app2
-        runAsUser: 0
+        securityContext:
+          runAsUser: 0
+          runAsGroup: 0