-
Sub-task
-
Resolution: Done
-
Major
-
None
-
None
-
None
-
2
-
False
-
-
False
-
-
-
OAPE Sprint 279
-
1
Test Execution Summary - SPIRE CSI Driver SCC (PR #56)
Test Date: November 6, 2025
PR : https://github.com/openshift/zero-trust-workload-identity-manager/pull/56
Component: SPIRE CSI Driver SCC
OpenShift Version: 4.20.0
Namespace: zero-trust-workload-identity-manage
Detailed Test Results
| # | Test Case | Status | Key Finding |
|---|---|---|---|
| 1 | Verify RunAsUser Strategy = MustRunAsRange | ✓ PASSED{color} | Non-root enforcement verified |
| 2 | Verify Required Dropped Capabilities = ALL | ✓ PASSED{color} | Security restriction confirmed |
| 3 | Verify Privileged Container Allowed = true | ✓ PASSED{color} | CSI driver requirements met |
| 4 | Verify Pod is Using Correct SCC | ✓ PASSED{color} | All pods using correct SCC |
| 5 | Verify SELinux Context is Applied | ✓ PASSED{color} | SELinux enforced properly |
| 6 | Verify All Capabilities are Dropped | ✓ PASSED{color} | ALL capabilities dropped |
| 7 | Verify CSI Driver Pods are Running | ✓ PASSED{color} | 3/3 DaemonSet pods healthy |
| 8 | Deploy Test Pod with CSI Volume | ✓ PASSED{color} | CSI mounting works |
| 9 | Verify SPIFFE Workload API Socket | ✓ PASSED{color} | Socket-based API confirmed |
| 10 | Attempt to Run Pod as Root | ⚠ PARTIAL{color} | Security enforced, behavior unclear |
| 11 | Attempt to Add Capability | ? NOT RUN{color} | Pending execution |
| 12 | Wrong Service Account Test | ✗ FAILED{color} | Authorization bypass bug |
Critical Bug Found - Test 12
OPENSHIFT SCC AUTHORIZATION BYPASS BUG
This is an OpenShift platform bug, NOT a SPIRE operator issue
Bug Summary:
Pod using unauthorized service account (default) was granted spire-spiffe-csi-driver SCC
Test Result:
Authorized SA: spire-spiffe-csi-driver (per SCC users: field) Test Pod SA: default (NOT authorized) Assigned SCC: spire-spiffe-csi-driver (WRONG! Authorization bypassed) Status: Running
Root Cause:
OpenShift SCC admission controller skips authorization check when security profile matches perfectly
Impact:
- Severity: MEDIUM-HIGH
- Authorization bypass - any pod can use restricted SCCs
- Security restrictions still enforced (mitigating factor)
Action:
Separate bug report filed: JIRA-Bug-Report.txt, test-scc-bug.sh
Overall Assessment
| Category | Result | Assessment |
|---|---|---|
| Functional Testing | 100% PASS{color} | SCC config correct, CSI working, no regression |
| Security Testing | BUG FOUND{color} | OpenShift platform authorization bypass |
| Overall | 75% PASS | PR #56: APPROVE / Platform: Bug Report |
Recommendations
PR #56 (SPIRE Operator): {color:green}✓ APPROVE{color}
- All SPIRE operator changes working correctly
- SCC configuration accurate and secure
- CSI driver functionality verified
- No regression in features
- Security restrictions properly enforced
OpenShift Platform: {color:red}✗ BUG REPORT REQUIRED{color}
- Component: OpenShift SCC Admission Controller
- Issue: Authorization bypass
- impacts account
-
SPIRE-256 OpenShift SCC Authorization Bypass Bug
-
- Closed
-
- links to