The effect of deleted policy still exits in the cluster

[viveksahu26]

Hey, @daemon1024 @nyrahul I don't understand why such uncertainity is seen with the policy.
Basically, I applied policy to block execution of sleep command and it works very well. Fine till here. Then I deleted that policy and try to execute the sleep command inside same container, but surprise to see its blocking from executing sleep command. Though policy has been deleted. Then why it seems like the effect of deleted policy still exits.

Below, there is no policy exit. But then also blocking from executing sleep command inside container.

controlplane $ k get kubearmorpolicy
No resources found in default namespace.
controlplane $ 
controlplane $ 
controlplane $ 
controlplane $ kubectl exec -it  ubuntu-1-deployment-54568945f9-8svqz  --  bash 
root@ubuntu-1-deployment-54568945f9-8svqz:/# sleep 4
bash: /bin/sleep: Permission denied
root@ubuntu-1-deployment-54568945f9-8svqz:/# 
root@ubuntu-1-deployment-54568945f9-8svqz:/# 

[viveksahu26]

controlplane $ kubectl get deploy -n kube-system
NAME                            READY   UP-TO-DATE   AVAILABLE   AGE
coredns                         2/2     2            2           10d
kubearmor-host-policy-manager   0/1     1            0           57s
kubearmor-policy-manager        0/1     1            0           57s
kubearmor-relay                 1/1     1            1           57s

[daemon1024]

Can you share the archive generated by karmor sysdump. This will compile the resources necessary for troubleshooting this issue into an archive. Thank You.

[viveksahu26]

I don't have above setup right now because I used in killercoda environment. By the way I would like to correct the above statement that the policy updating the policy doesn't work. Steps to proceed.

1. Create deployment

apiVersion: apps/v1
kind: Deployment
metadata:
 name: ubuntu-1-deployment
 labels:
   deployment: ubuntu-1
spec:
 replicas: 1
 selector:
   matchLabels:
     group: group-1
     container: ubuntu-1
 template:
   metadata:
     labels:
       group: group-1
       container: ubuntu-1
       security: apparmor
       distros: ubuntu
   spec:
     containers:
       - name: ubuntu-1-container
         image: nginx

Now, apply kubearmor policy

apiVersion: security.kubearmor.com/v1
kind: KubeArmorPolicy
metadata:
  name: ksp-group-1-proc-path-block
spec:
  severity: 5
  message: "block the sleep command"
  selector:
    matchLabels:
      group: group-1
  process:
    matchPaths:
    - path: /bin/sleep # try sleep 1 (permission denied)
  action:
    Block

Now get into container shell and run sleep command and it works fine. Means it blocked as stated in the policy.

3. Now, update the policy. And change the label in such a way that it doesn't match container.

kubectl edit kubearmorpolicy ksp-group-1-proc-path-block

And change label from group: group-1 to group: group-100.
4) Get into container shell and run sleep command. It will block it. I don't know why it does so ? According to me it shouldn't block sleep command from executing.

5. At last delete the above policy

kubectl delete kubearmorpolicy ksp-group-1-proc-path-block

6. Now again get into container shell and run sleep command. It will block it. I don't know why it does so ? According to me it shouldn't block sleep command from executing because policy no more exits.

[daemon1024]

Can you try recreating the environment and reproducing the issue? And in that state generate the sysdump archive and share it. Thank You.