From 85b0b7d5c07377ba65d5045db1da6c4a37817a2f Mon Sep 17 00:00:00 2001 From: taimurhafeez Date: Mon, 27 Jul 2026 17:27:20 +0100 Subject: [PATCH 1/2] CMP-4439: Add manual rule kubevirt-restrict-update-access-to-cdi-cr (CIS OCP-Virt 1.14) --- .../rule.yml | 32 +++++++++++++++++++ .../ocp4/profiles/cis-vm-extension.profile | 1 + 2 files changed, 33 insertions(+) create mode 100644 applications/openshift-virtualization/kubevirt-restrict-update-access-to-cdi-cr/rule.yml diff --git a/applications/openshift-virtualization/kubevirt-restrict-update-access-to-cdi-cr/rule.yml b/applications/openshift-virtualization/kubevirt-restrict-update-access-to-cdi-cr/rule.yml new file mode 100644 index 000000000000..8243bf08124e --- /dev/null +++ b/applications/openshift-virtualization/kubevirt-restrict-update-access-to-cdi-cr/rule.yml @@ -0,0 +1,32 @@ +documentation_complete: true + +title: 'Restrict Update Access to the CDI CR' + +description: |- + Only authorized subjects should be allowed to update the + CDI custom resource. The CDI (Containerized Data Importer) + CR controls how virtual machine disk images are imported, uploaded, + and cloned within the cluster. Unrestricted update access allows + any subject to modify CDI settings, potentially enabling insecure + data import sources, disabling TLS verification, or altering + storage configurations. + +rationale: |- + The CDI custom resource governs the data import pipeline for + virtual machine disk images in OpenShift Virtualization. Modifying + this resource can change upload proxy settings, scratch space + allocation, and image import behavior. If unauthorized subjects + can update the CDI CR, they may introduce insecure import sources, + weaken transport security, or disrupt the disk image provisioning + workflow. Restricting update access ensures that only approved + administrators can alter CDI configuration. + +severity: medium + +ocil_clause: 'unauthorized subjects can update the CDI CR' + +ocil: |- + Run the following command to check which subjects can update the + CDI custom resource: + 
$ oc adm policy who-can update cdi
+ Verify that only authorized subjects are listed in the output. diff --git a/products/ocp4/profiles/cis-vm-extension.profile b/products/ocp4/profiles/cis-vm-extension.profile index 9c3e034f0bb9..acc0c209db19 100644 --- a/products/ocp4/profiles/cis-vm-extension.profile +++ b/products/ocp4/profiles/cis-vm-extension.profile @@ -36,6 +36,7 @@ selections: - kubevirt-sriov-spoofchk-on - kubevirt-bridge-mac-spoof-filtering - kubevirt-restrict-migration-tools-access + - kubevirt-restrict-update-access-to-cdi-cr - kubevirt-downward-metrics-disabled - kubevirt-ksm-disabled - kubevirt-no-jsonpatch-annotations From eadbae514ab9378ce97279ff1860016142855559 Mon Sep 17 00:00:00 2001 From: taimurhafeez Date: Thu, 6 Aug 2026 12:21:47 +0100 Subject: [PATCH 2/2] Update description with CustomRule guidance per review. Replace description that explains manual status and points organizations to CustomRules for automation. Co-Authored-By: Claude Opus 4.6 (1M context) --- .../rule.yml | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/applications/openshift-virtualization/kubevirt-restrict-update-access-to-cdi-cr/rule.yml b/applications/openshift-virtualization/kubevirt-restrict-update-access-to-cdi-cr/rule.yml index 8243bf08124e..053078222d37 100644 --- a/applications/openshift-virtualization/kubevirt-restrict-update-access-to-cdi-cr/rule.yml +++ b/applications/openshift-virtualization/kubevirt-restrict-update-access-to-cdi-cr/rule.yml @@ -3,13 +3,11 @@ documentation_complete: true title: 'Restrict Update Access to the CDI CR' description: |- - Only authorized subjects should be allowed to update the - CDI custom resource. The CDI (Containerized Data Importer) - CR controls how virtual machine disk images are imported, uploaded, - and cloned within the cluster. Unrestricted update access allows - any subject to modify CDI settings, potentially enabling insecure - data import sources, disabling TLS verification, or altering - storage configurations. + Because the set of authorized subjects is specific to each + organization, this rule requires manual verification. Organizations + can create a compliance-operator CustomRule with CEL expressions + that evaluate ClusterRoleBindings and Roles to verify that only + their approved subjects hold update access to CDI resources. rationale: |- The CDI custom resource governs the data import pipeline for