shazadbrohi’s gists

shazadbrohi / restricted-psp.yaml

Last active November 4, 2020 07:53

A restricted pod security policy

	apiVersion: policy/v1beta1
	kind: PodSecurityPolicy
	metadata:
	name: my-restricted-psp
	spec:
	privileged: false
	# Required to prevent escalations to root.
	allowPrivilegeEscalation: false
	# Allow core volume types.
	volumes:

shazadbrohi / restricted-psp-rbac.yaml

Last active November 4, 2020 07:56

A set of RBAC resources to enforce the restricted psp across all service accounts

	apiVersion: rbac.authorization.k8s.io/v1
	kind: ClusterRole
	metadata:
	name: restricted-cluster-role
	rules:
	- apiGroups:
	- policy
	resourceNames:
	- restricted-psp
	resources:

shazadbrohi / privileged-psp.yaml

Created November 2, 2020 23:07

A privileged pod security policy resource

	apiVersion: policy/v1beta1
	kind: PodSecurityPolicy
	metadata:
	name: privileged-psp
	spec:
	allowPrivilegeEscalation: true
	allowedCapabilities:
	- '*'
	fsGroup:
	rule: RunAsAny

shazadbrohi / privileged-cluster-role.yaml

Created November 2, 2020 23:14

A cluster role which authorizes use of the privileged-psp.

	apiVersion: rbac.authorization.k8s.io/v1
	kind: ClusterRole
	metadata:
	name: privileged-cluster-role
	rules:
	- apiGroups:
	- policy
	resourceNames:
	- privileged-psp
	resources:

shazadbrohi / namespaced-privileged-access.yaml

Created November 2, 2020 23:20

Grants all service accounts in a specific namespace permission to use the privileged pod security policy.

	apiVersion: rbac.authorization.k8s.io/v1
	kind: RoleBinding
	metadata:
	name: <name>-role-binding
	namespace: <your-namespace>
	roleRef:
	apiGroup: rbac.authorization.k8s.io
	kind: ClusterRole
	name: privileged-cluster-role
	subjects:

shazadbrohi / workload-specific-binding.yaml

Last active November 2, 2020 23:41

Grants permission to a specific workload to use the privileged pod security policy.

	apiVersion: rbac.authorization.k8s.io/v1
	kind: RoleBinding
	metadata:
	name: <role-binding-name>
	namespace: <your-namespace>
	roleRef:
	apiGroup: rbac.authorization.k8s.io
	kind: ClusterRole
	name: privileged-cluster-role
	subjects:

shazadbrohi / ls.go

Last active January 30, 2021 23:09

ls.go

	package main

	import (
	"fmt"
	"io/ioutil"
	)

	func main(){
	fmt.Println("Reading contents of current directory: ")
	files, err := ioutil.ReadDir(".")

shazadbrohi / compile.sh

Last active January 30, 2021 23:06

$ go build ls.go

shazadbrohi / run.sh

Created January 30, 2021 22:37

$ ./ls

shazadbrohi / output.sh

Created January 30, 2021 22:38

	$ ./ls
	Reading contents of current directory:
	Name: ls, Size: 2190488, Last Modified Time: 2021-01-30 16:36:15.436720922 -0600 CST
	Name: ls.go, Size: 334, Last Modified Time: 2021-01-30 16:34:42.99726847 -0600 CST

Shazad Brohi shazadbrohi