genpolicy: support container images without PATH env var

Which feature do you think can be improved?

Policy generation with the genpolicy tool

How can it be improved?

genpolicy should check whether the image config contains a PATH environment variable. If it does not find a PATH, it should add a default PATH allowlist entry to the policy.

Additional Information

If there is no PATH in the container image config, the Kata runtime sets a default PATH for the OCI runtime config. I don't know where this is specified, but it seems to be common for CRI implementations and is also found in official OCI tooling, so it probably makes sense to support that.

This default value is not part of the genpolicy settings, and I think that is correct for images that have a path. For images that don't have a path, the generated policy should match the legitimate behaviour of the Kata runtime.

Example image that does not pass policy check:

apiVersion: v1
kind: Pod
metadata:
  name: test
spec:
  runtimeClassName: kata-cc-isolation
  containers:
    - name: shell
      image: "ghcr.io/burgerdev/tmp/busybox:noenv"
      command:
        - /bin/sh
        - "-xc"
        - while true; do sleep 100; done

Workaround

apiVersion: v1
kind: Pod
metadata:
  name: test
spec:
  runtimeClassName: kata-cc-isolation
  containers:
    - name: shell
      image: "ghcr.io/burgerdev/tmp/busybox:noenv"
      command:
        - /bin/sh
        - "-xc"
        - while true; do sleep 100; done
      env:
        - name: PATH
          value: /bin

Before raising this enhancement request

Have you looked at the limitations document?

Yes, not mentioned.

Kata Containers survey

Please consider taking the survey to help us help you: https://openinfrafoundation.formstack.com/forms/kata_containers_user_survey

Ack