Merge pull request #92 from CodesWhat/feat/swarm-user-privileges-parity

✨ feat(filter): swarm ContainerSpec User/Privileges enforcement parity

Author: scttbnsn

CHANGELOG.md

@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- **Swarm service create/update now enforces the container-create identity/privilege rails.** Four opt-in `request_body.service` knobs mirror their container-create counterparts onto the swarm `ContainerSpec`, closing a bypass where a service could request a workload posture that `/containers/create` would have denied: `require_non_root_user` (`ContainerSpec.User`), `require_no_new_privileges` (`ContainerSpec.Privileges.NoNewPrivileges`), `require_readonly_rootfs` (`ContainerSpec.ReadOnly`), and `require_drop_all_capabilities` (`ContainerSpec.CapabilityDrop` must include `ALL`). All default off. The root-user check reuses the same numeric-UID parsing as container-create, so zero-padded `"00"`/`"0:0"` forms are rejected. (Swarm has no privileged mode, per-service namespace sharing, or runtime/device selection, so those container-create rails have no service equivalent.)
+
 ### Security
 
 - **Zero-padded numeric UIDs can no longer bypass root-user enforcement.** `require_non_root_user` (container create) and `allow_root_user: false` (exec) compared the user field to the exact string `"0"`, but Docker parses `Config.User` numerically — so `"00"`, `"000"`, or `"0000:5"` all run as root while slipping past the check. Both inspectors now parse the UID and treat any value resolving to 0 as root.

README.md

@@ -461,7 +461,7 @@ LinuxServer's socket-proxy env surface is already Tecnativa-compatible for the b
 
 | Tier | Theme |
 |---|---|
-| Security hardening (v1.x) | Continued mutation-test hardening of the rule-evaluation core and config validators; swarm `ContainerSpec.User` / `Privileges` enforcement parity with container create; `HostConfig.SecurityOpt` `label=`/`systempaths=` policy evaluation (currently passed through) |
+| Security hardening (v1.x) | Continued mutation-test hardening of the rule-evaluation core and config validators; swarm `ContainerSpec` seccomp/AppArmor mode enforcement parity (the `Privileges.NoNewPrivileges`, `User`, `ReadOnly`, and `CapabilityDrop` rails already mirror container-create); `HostConfig.SecurityOpt` `label=`/`systempaths=` policy evaluation (currently passed through) |
 | Policy refinement (v1.x) | Multiple frontend listeners on the main proxy, named rule path aliases |
 | Internals (v1.x) | Code-review backlog: collapse the config → filter-options → policy translation layers behind a single source of truth (generated Viper defaults); allocation-free rate-limit bucket state (packed `atomic.Uint64`); profiling-gated JSON redaction fast path; clear per-profile in-flight gauges when a hot reload removes the profile |
 | Compliance (v1.x) | CIS Docker Benchmark control mapping, audit-ready policy templates |

app/internal/config/config.go

@@ -293,15 +293,19 @@ type ConfigRequestBodyConfig struct {
 
 // ServiceRequestBodyConfig configures inspection for service create/update.
 type ServiceRequestBodyConfig struct {
-	AllowHostNetwork     bool             `mapstructure:"allow_host_network"`
-	AllowedBindMounts    []string         `mapstructure:"allowed_bind_mounts"`
-	AllowAllRegistries   bool             `mapstructure:"allow_all_registries"`
-	AllowOfficial        bool             `mapstructure:"allow_official"`
-	AllowedRegistries    []string         `mapstructure:"allowed_registries"`
-	AllowAllCapabilities bool             `mapstructure:"allow_all_capabilities"`
-	AllowedCapabilities  []string         `mapstructure:"allowed_capabilities"`
-	AllowSysctls         bool             `mapstructure:"allow_sysctls"`
-	ImageTrust           ImageTrustConfig `mapstructure:"image_trust"`
+	AllowHostNetwork           bool             `mapstructure:"allow_host_network"`
+	AllowedBindMounts          []string         `mapstructure:"allowed_bind_mounts"`
+	AllowAllRegistries         bool             `mapstructure:"allow_all_registries"`
+	AllowOfficial              bool             `mapstructure:"allow_official"`
+	AllowedRegistries          []string         `mapstructure:"allowed_registries"`
+	AllowAllCapabilities       bool             `mapstructure:"allow_all_capabilities"`
+	AllowedCapabilities        []string         `mapstructure:"allowed_capabilities"`
+	AllowSysctls               bool             `mapstructure:"allow_sysctls"`
+	RequireNonRootUser         bool             `mapstructure:"require_non_root_user"`
+	RequireNoNewPrivileges     bool             `mapstructure:"require_no_new_privileges"`
+	RequireReadonlyRootfs      bool             `mapstructure:"require_readonly_rootfs"`
+	RequireDropAllCapabilities bool             `mapstructure:"require_drop_all_capabilities"`
+	ImageTrust                 ImageTrustConfig `mapstructure:"image_trust"`
 }
 
 // SwarmRequestBodyConfig configures inspection for swarm writes.

app/internal/config/filter_options.go

@@ -179,15 +179,19 @@ func (c ConfigRequestBodyConfig) ToFilterOptions() filter.ConfigOptions {
 
 func (c ServiceRequestBodyConfig) ToFilterOptions() filter.ServiceOptions {
 	return filter.ServiceOptions{
-		AllowHostNetwork:     c.AllowHostNetwork,
-		AllowedBindMounts:    c.AllowedBindMounts,
-		AllowAllRegistries:   c.AllowAllRegistries,
-		AllowOfficial:        c.AllowOfficial,
-		AllowedRegistries:    c.AllowedRegistries,
-		AllowAllCapabilities: c.AllowAllCapabilities,
-		AllowedCapabilities:  c.AllowedCapabilities,
-		AllowSysctls:         c.AllowSysctls,
-		ImageTrust:           c.ImageTrust.toFilterOptions(),
+		AllowHostNetwork:           c.AllowHostNetwork,
+		AllowedBindMounts:          c.AllowedBindMounts,
+		AllowAllRegistries:         c.AllowAllRegistries,
+		AllowOfficial:              c.AllowOfficial,
+		AllowedRegistries:          c.AllowedRegistries,
+		AllowAllCapabilities:       c.AllowAllCapabilities,
+		AllowedCapabilities:        c.AllowedCapabilities,
+		AllowSysctls:               c.AllowSysctls,
+		RequireNonRootUser:         c.RequireNonRootUser,
+		RequireNoNewPrivileges:     c.RequireNoNewPrivileges,
+		RequireReadonlyRootfs:      c.RequireReadonlyRootfs,
+		RequireDropAllCapabilities: c.RequireDropAllCapabilities,
+		ImageTrust:                 c.ImageTrust.toFilterOptions(),
 	}
 }
 

app/internal/config/filter_options_test.go

@@ -82,11 +82,15 @@ func TestRequestBodyConfigToFilterOptionsMapsEveryPolicy(t *testing.T) {
 			AllowTemplateDrivers: true,
 		},
 		Service: ServiceRequestBodyConfig{
-			AllowHostNetwork:   true,
-			AllowedBindMounts:  []string{"/srv/services"},
-			AllowAllRegistries: true,
-			AllowOfficial:      false,
-			AllowedRegistries:  []string{"registry.example.com"},
+			AllowHostNetwork:           true,
+			AllowedBindMounts:          []string{"/srv/services"},
+			AllowAllRegistries:         true,
+			AllowOfficial:              false,
+			AllowedRegistries:          []string{"registry.example.com"},
+			RequireNonRootUser:         true,
+			RequireNoNewPrivileges:     true,
+			RequireReadonlyRootfs:      true,
+			RequireDropAllCapabilities: true,
 		},
 		Swarm: SwarmRequestBodyConfig{
 			AllowForceNewCluster:          true,
@@ -196,11 +200,15 @@ func TestRequestBodyConfigToFilterOptionsMapsEveryPolicy(t *testing.T) {
 			AllowTemplateDrivers: true,
 		},
 		Service: filter.ServiceOptions{
-			AllowHostNetwork:   true,
-			AllowedBindMounts:  []string{"/srv/services"},
-			AllowAllRegistries: true,
-			AllowOfficial:      false,
-			AllowedRegistries:  []string{"registry.example.com"},
+			AllowHostNetwork:           true,
+			AllowedBindMounts:          []string{"/srv/services"},
+			AllowAllRegistries:         true,
+			AllowOfficial:              false,
+			AllowedRegistries:          []string{"registry.example.com"},
+			RequireNonRootUser:         true,
+			RequireNoNewPrivileges:     true,
+			RequireReadonlyRootfs:      true,
+			RequireDropAllCapabilities: true,
 		},
 		Swarm: filter.SwarmOptions{
 			AllowForceNewCluster:          true,

app/internal/config/load.go

@@ -159,6 +159,10 @@ func setLoadDefaults(v *viper.Viper, defaults Config) {
 	v.SetDefault("request_body.service.allow_all_capabilities", defaults.RequestBody.Service.AllowAllCapabilities)
 	v.SetDefault("request_body.service.allowed_capabilities", defaults.RequestBody.Service.AllowedCapabilities)
 	v.SetDefault("request_body.service.allow_sysctls", defaults.RequestBody.Service.AllowSysctls)
+	v.SetDefault("request_body.service.require_non_root_user", defaults.RequestBody.Service.RequireNonRootUser)
+	v.SetDefault("request_body.service.require_no_new_privileges", defaults.RequestBody.Service.RequireNoNewPrivileges)
+	v.SetDefault("request_body.service.require_readonly_rootfs", defaults.RequestBody.Service.RequireReadonlyRootfs)
+	v.SetDefault("request_body.service.require_drop_all_capabilities", defaults.RequestBody.Service.RequireDropAllCapabilities)
 	v.SetDefault("request_body.container_create.image_trust.require_rekor_inclusion", defaults.RequestBody.ContainerCreate.ImageTrust.RequireRekorInclusion)
 	v.SetDefault("request_body.container_create.image_trust.verify_timeout", defaults.RequestBody.ContainerCreate.ImageTrust.VerifyTimeout)
 	v.SetDefault("request_body.service.image_trust.require_rekor_inclusion", defaults.RequestBody.Service.ImageTrust.RequireRekorInclusion)

app/internal/config/load_env_defaults_test.go

@@ -19,6 +19,34 @@ func TestLoadHonorsAllowSysctlsEnvVar(t *testing.T) {
 	}
 }
 
+func TestLoadHonorsServiceHardeningEnvVars(t *testing.T) {
+	// The swarm-parity hardening rails are env-only unless registered in
+	// setLoadDefaults; guard all four so a missing SetDefault can't silently
+	// drop them.
+	t.Setenv("SOCKGUARD_REQUEST_BODY_SERVICE_REQUIRE_NON_ROOT_USER", "true")
+	t.Setenv("SOCKGUARD_REQUEST_BODY_SERVICE_REQUIRE_NO_NEW_PRIVILEGES", "true")
+	t.Setenv("SOCKGUARD_REQUEST_BODY_SERVICE_REQUIRE_READONLY_ROOTFS", "true")
+	t.Setenv("SOCKGUARD_REQUEST_BODY_SERVICE_REQUIRE_DROP_ALL_CAPABILITIES", "true")
+
+	cfg, err := Load("/nonexistent-so-defaults-and-env-only.yaml")
+	if err != nil {
+		t.Fatalf("Load() = %v", err)
+	}
+	svc := cfg.RequestBody.Service
+	if !svc.RequireNonRootUser {
+		t.Error("RequireNonRootUser = false, want true from env")
+	}
+	if !svc.RequireNoNewPrivileges {
+		t.Error("RequireNoNewPrivileges = false, want true from env")
+	}
+	if !svc.RequireReadonlyRootfs {
+		t.Error("RequireReadonlyRootfs = false, want true from env")
+	}
+	if !svc.RequireDropAllCapabilities {
+		t.Error("RequireDropAllCapabilities = false, want true from env")
+	}
+}
+
 func TestLoadHonorsImageTrustVerifyTimeoutEnvVar(t *testing.T) {
 	t.Setenv("SOCKGUARD_REQUEST_BODY_CONTAINER_CREATE_IMAGE_TRUST_VERIFY_TIMEOUT", "30s")
 	t.Setenv("SOCKGUARD_REQUEST_BODY_SERVICE_IMAGE_TRUST_VERIFY_TIMEOUT", "45s")

app/internal/filter/service.go

@@ -28,34 +28,63 @@ type ServiceOptions struct {
 	AllowedCapabilities  []string
 	// AllowSysctls permits ContainerSpec.Sysctls; default false denies any.
 	AllowSysctls bool
+	// RequireNonRootUser / RequireNoNewPrivileges / RequireReadonlyRootfs /
+	// RequireDropAllCapabilities mirror the container-create hardening rails for
+	// swarm task containers, enforced against ContainerSpec.User,
+	// ContainerSpec.Privileges.NoNewPrivileges, ContainerSpec.ReadOnly, and
+	// ContainerSpec.CapabilityDrop respectively.
+	RequireNonRootUser         bool
+	RequireNoNewPrivileges     bool
+	RequireReadonlyRootfs      bool
+	RequireDropAllCapabilities bool
 	// ImageTrust applies cosign verification to ContainerSpec.Image, matching
 	// the container-create path so swarm services cannot escape image trust.
 	ImageTrust ImageTrustOptions
 }
 
 type servicePolicy struct {
-	allowHostNetwork     bool
-	allowedBindMounts    []string
-	imagePolicy          imagePullPolicy
-	allowAllCapabilities bool
-	allowedCapabilities  []string
-	allowSysctls         bool
-	imageTrust           imageTrustFields
+	allowHostNetwork           bool
+	allowedBindMounts          []string
+	imagePolicy                imagePullPolicy
+	allowAllCapabilities       bool
+	allowedCapabilities        []string
+	allowSysctls               bool
+	requireNonRootUser         bool
+	requireNoNewPrivileges     bool
+	requireReadonlyRootfs      bool
+	requireDropAllCapabilities bool
+	imageTrust                 imageTrustFields
 }
 
 type serviceRequest struct {
 	TaskTemplate struct {
-		ContainerSpec struct {
-			Image          string            `json:"Image"`
-			Mounts         []serviceMount    `json:"Mounts"`
-			CapabilityAdd  []string          `json:"CapabilityAdd"`
-			CapabilityDrop []string          `json:"CapabilityDrop"`
-			Sysctls        map[string]string `json:"Sysctls"`
-		} `json:"ContainerSpec"`
+		ContainerSpec serviceContainerSpec `json:"ContainerSpec"`
 	} `json:"TaskTemplate"`
 	Networks []serviceNetwork `json:"Networks"`
 }
 
+// serviceContainerSpec mirrors the subset of Docker's swarm ContainerSpec that
+// Sockguard inspects. Identity/privilege fields (User, ReadOnly, Privileges,
+// CapabilityDrop) carry the swarm equivalents of the container-create hardening
+// rails so service create/update cannot bypass them.
+type serviceContainerSpec struct {
+	Image          string                      `json:"Image"`
+	User           string                      `json:"User"`
+	Mounts         []serviceMount              `json:"Mounts"`
+	CapabilityAdd  []string                    `json:"CapabilityAdd"`
+	CapabilityDrop []string                    `json:"CapabilityDrop"`
+	Sysctls        map[string]string           `json:"Sysctls"`
+	ReadOnly       bool                        `json:"ReadOnly"`
+	Privileges     *serviceContainerPrivileges `json:"Privileges"`
+}
+
+// serviceContainerPrivileges captures the swarm ContainerSpec.Privileges fields
+// Sockguard enforces. NoNewPrivileges is a direct boolean here, unlike the
+// container-create path where it is encoded as a HostConfig.SecurityOpt string.
+type serviceContainerPrivileges struct {
+	NoNewPrivileges bool `json:"NoNewPrivileges"`
+}
+
 type serviceMount struct {
 	Type   string `json:"Type"`
 	Source string `json:"Source"`
@@ -83,13 +112,38 @@ func newServicePolicy(opts ServiceOptions) servicePolicy {
 			AllowOfficial:      opts.AllowOfficial,
 			AllowedRegistries:  opts.AllowedRegistries,
 		}),
-		allowAllCapabilities: opts.AllowAllCapabilities,
-		allowedCapabilities:  normalizeCapabilityList(opts.AllowedCapabilities),
-		allowSysctls:         opts.AllowSysctls,
-		imageTrust:           buildImageTrustFields(opts.ImageTrust),
+		allowAllCapabilities:       opts.AllowAllCapabilities,
+		allowedCapabilities:        normalizeCapabilityList(opts.AllowedCapabilities),
+		allowSysctls:               opts.AllowSysctls,
+		requireNonRootUser:         opts.RequireNonRootUser,
+		requireNoNewPrivileges:     opts.RequireNoNewPrivileges,
+		requireReadonlyRootfs:      opts.RequireReadonlyRootfs,
+		requireDropAllCapabilities: opts.RequireDropAllCapabilities,
+		imageTrust:                 buildImageTrustFields(opts.ImageTrust),
 	}
 }
 
+// denyHardeningReason enforces the swarm equivalents of the container-create
+// boolean rails against ContainerSpec. It reuses the same isNonRootUser and
+// capDropContainsAll helpers so service and container policy stay in lockstep.
+// NoNewPrivileges is a direct ContainerSpec.Privileges boolean rather than a
+// SecurityOpt string; a nil Privileges block means the flag is unset (denied).
+func (p servicePolicy) denyHardeningReason(spec serviceContainerSpec) string {
+	if p.requireNoNewPrivileges && (spec.Privileges == nil || !spec.Privileges.NoNewPrivileges) {
+		return "service denied: no-new-privileges is required (set ContainerSpec.Privileges.NoNewPrivileges to true)"
+	}
+	if p.requireNonRootUser && !isNonRootUser(spec.User) {
+		return "service denied: non-root user is required (set ContainerSpec.User to a non-zero UID or non-root username)"
+	}
+	if p.requireReadonlyRootfs && !spec.ReadOnly {
+		return "service denied: read-only root filesystem is required (set ContainerSpec.ReadOnly to true)"
+	}
+	if p.requireDropAllCapabilities && !capDropContainsAll(spec.CapabilityDrop) {
+		return "service denied: ContainerSpec.CapabilityDrop must include \"ALL\""
+	}
+	return ""
+}
+
 func (p servicePolicy) inspect(logger *slog.Logger, r *http.Request, normalizedPath string) (string, error) {
 	if r == nil || r.Method != http.MethodPost || !isServiceWritePath(normalizedPath) || r.Body == nil {
 		return "", nil
@@ -134,6 +188,14 @@ func (p servicePolicy) inspect(logger *slog.Logger, r *http.Request, normalizedP
 		return fmt.Sprintf("service denied: bind mount source %q is not allowlisted", source), nil
 	}
 
+	// Identity/privilege rails: ContainerSpec carries swarm equivalents of the
+	// container-create hardening knobs (User, Privileges.NoNewPrivileges,
+	// ReadOnly, CapabilityDrop). Enforce them so service create/update is not a
+	// bypass of require_non_root_user and friends.
+	if denyReason := p.denyHardeningReason(req.TaskTemplate.ContainerSpec); denyReason != "" {
+		return denyReason, nil
+	}
+
 	// Swarm task containers can grant Linux capabilities and set sysctls via
 	// ContainerSpec, exactly like /containers/create — enforce the same rails so
 	// service create/update is not a bypass of the container-create policy.