fix: add system authenticate bind protection policy

[chen-keinan]

Following to security risk raised on system:authenticate adding a new policy to handle this case

[knqyf263]

I don't recall if we have such logic, but can we apply this policy to only GKE clusters?

[chen-keinan]

@knqyf263 no we can't , there is an issue to pass distribution type as rego input (will be done later). this policy is important for all distribution it is more exposable for GKE

[knqyf263]

this policy is important for all distribution it is more exposable for GKE

IIUC, as it is infinitely unlikely that the system:authenticated group will be assigned to an attacker in non-GKE clusters, I'm concerned that the detection of this check as CRITICAL will be noise. This could frighten many EKS and AKS users.

[chen-keinan]

this policy is important for all distribution it is more exposable for GKE

IIUC, as it is infinitely unlikely that the system:authenticated group will be assigned to an attacker in non-GKE clusters, I'm concerned that the detection of this check as CRITICAL will be noise. This could frighten many EKS and AKS users.

the chances for system:authenticated group to by bind to a Role/ClusterRole is the same for all (GKE and non GKE) as this can be done by mistake, the problem with GKE is the generated Token which can be easily abused

[knqyf263]

the chances for system:authenticated group to by bind to a Role/ClusterRole is the same for all (GKE and non GKE) as this can be done by mistake

Yes, but the misconfiguration itself is not a critical problem as it's hard to get system:authenticated assigned in non GKE clusters. In most cases, non-GKE clusters are not exploitable even if system:authenticated has Role/ClusterRole. Therefore, the severity should be LOW or NOTICE (Trivy doesn't have NOTICE, though) for clusters other than GKE.

[knqyf263]

@chen-keinan Any comments?

[chen-keinan]

@chen-keinan Any comments?

I'll change the severity to Low

[knqyf263]

But it is critical for GKE.

• GKE: CRITICAL
• Non-GKE: LOW

We want to achieve it somehow.