Fix for the false positive of access-control's capabilities tcs.

tests/accesscontrol/suite.go

@@ -38,6 +38,7 @@ import (
 	"github.com/redhat-best-practices-for-k8s/certsuite/tests/identifiers"
 	"github.com/redhat-best-practices-for-k8s/certsuite/tests/networking/netutil"
 	"github.com/redhat-best-practices-for-k8s/certsuite/tests/networking/services"
+	v1 "k8s.io/api/core/v1"
 	rbacv1 "k8s.io/api/rbac/v1"
 )
 
@@ -263,6 +264,25 @@ func LoadChecks() {
 		}))
 }
 
+// isContainerCapabilitySet checks whether a container capability was explicitly set
+// in securityContext.capabilities.add list.
+func isContainerCapabilitySet(containerCapabilities *v1.Capabilities, capability string) bool {
+	if containerCapabilities == nil {
+		return false
+	}
+
+	if len(containerCapabilities.Add) == 0 {
+		return false
+	}
+
+	if stringhelper.StringInSlice(containerCapabilities.Add, v1.Capability("ALL"), true) ||
+		stringhelper.StringInSlice(containerCapabilities.Add, v1.Capability(capability), true) {
+		return true
+	}
+
+	return false
+}
+
 // checkForbiddenCapability checks if containers use a forbidden capability.
 // Returns:
 //   - compliantObjects []*testhelper.ReportObject : Slice containing report objects for containers compliant with the capability restrictions.
@@ -275,7 +295,7 @@ func checkForbiddenCapability(containers []*provider.Container, capability strin
 		switch {
 		case cut.SecurityContext == nil:
 		case cut.SecurityContext.Capabilities == nil:
-		case strings.Contains(cut.SecurityContext.Capabilities.String(), capability):
+		case isContainerCapabilitySet(cut.SecurityContext.Capabilities, capability):
 			compliant = false
 		}
 

tests/accesscontrol/suite_test.go

@@ -15,3 +15,112 @@
 // 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 
 package accesscontrol
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	v1 "k8s.io/api/core/v1"
+)
+
+func Test_isContainerCapabilitySet(t *testing.T) {
+	type args struct {
+		containerCapabilities *v1.Capabilities
+		capability            string
+	}
+	tests := []struct {
+		name string
+		args args
+		want bool
+	}{
+		{
+			name: "nil capabilities",
+			args: args{
+				capability:            "IPC_LOCK",
+				containerCapabilities: nil,
+			},
+			want: false,
+		},
+		{
+			name: "empty capabilities",
+			args: args{
+				capability:            "IPC_LOCK",
+				containerCapabilities: &v1.Capabilities{},
+			},
+			want: false,
+		},
+		{
+			name: "explicitly empty add list",
+			args: args{
+				capability:            "IPC_LOCK",
+				containerCapabilities: &v1.Capabilities{Add: []v1.Capability{}},
+			},
+			want: false,
+		},
+		{
+			name: "explicitly empty drop list",
+			args: args{
+				capability:            "IPC_LOCK",
+				containerCapabilities: &v1.Capabilities{Drop: []v1.Capability{}},
+			},
+			want: false,
+		},
+		{
+			name: "IPC_LOCK not found in any list",
+			args: args{
+				capability: "IPC_LOCK",
+				containerCapabilities: &v1.Capabilities{
+					Add:  []v1.Capability{"NET_CAP_BINDING"},
+					Drop: []v1.Capability{"SYS_ADMIN", "NET_ADMIN"},
+				},
+			},
+			want: false,
+		},
+		{
+			name: "IPC_LOCK found in the add list",
+			args: args{
+				capability: "IPC_LOCK",
+				containerCapabilities: &v1.Capabilities{
+					Add:  []v1.Capability{"NET_ADMIN", "IPC_LOCK"},
+					Drop: []v1.Capability{"SYS_ADMIN"}},
+			},
+			want: true,
+		},
+		{
+			name: "IPC_LOCK appears in the drop list only",
+			args: args{
+				capability:            "IPC_LOCK",
+				containerCapabilities: &v1.Capabilities{Drop: []v1.Capability{"SYS_ADMIN", "IPC_LOCK", "NET_ADMIN"}},
+			},
+			want: false,
+		},
+		{
+			// When set in both add and drop lists, k8s/openshift will compute drop first, then add, which results
+			// in the capability to be finally set.
+			name: "IPC_LOCK set in both add and drop lists.",
+			args: args{
+				capability: "IPC_LOCK",
+				containerCapabilities: &v1.Capabilities{
+					Add:  []v1.Capability{"IPC_LOCK"},
+					Drop: []v1.Capability{"SYS_ADMIN", "IPC_LOCK", "NET_ADMIN"},
+				},
+			},
+			want: true,
+		},
+		{
+			name: "ALL capabilities in the add list",
+			args: args{
+				capability:            "IPC_LOCK",
+				containerCapabilities: &v1.Capabilities{Add: []v1.Capability{"ALL"}},
+			},
+			want: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := isContainerCapabilitySet(tt.args.containerCapabilities, tt.args.capability); got != tt.want {
+				assert.Equal(t, tt.want, got)
+			}
+		})
+	}
+}