@zhuma4/cli 4.0.0-alpha.1

package/rules/iac/zm-docker-security.yaml

@@ -0,0 +1,104 @@
+# 逐码 ZhuMa IaC 规则 — Dockerfile 安全检测
+# V4.1 Sprint 3 起步 — 首批5条覆盖最常见的 Docker 镜像构建安全问题
+
+rules:
+  # ZM-IAC-DOCKER-001: FROM 使用 latest tag
+  - id: zm-iac-docker-latest-001
+    severity: LOW
+    message: |
+      FROM 使用 `latest` tag — 每次构建拉取不同镜像，不可重现。
+      使用语义化版本固定基础镜像标签，例如 `node:20-alpine` 而非 `node:latest`。
+    languages:
+      - dockerfile
+    pattern: |
+      FROM $IMAGE:latest
+    metadata:
+      cwe: "CWE-1104: Use of Unmaintained Third Party Components"
+      owasp: "A06:2021 - Vulnerable and Outdated Components"
+      precision: very-high
+      tags: [docker, supply-chain, reproducibility]
+
+  # ZM-IAC-DOCKER-002: RUN curl/wget 后未清理缓存
+  - id: zm-iac-docker-curl-cleanup-001
+    severity: LOW
+    message: |
+      `curl`/`wget` 拉取文件后未在同层 `RUN` 中删除临时文件 — 镜像膨胀且残留敏感信息。
+      合并为单条 `RUN curl ... && rm -f /tmp/... && apk del curl` 或使用 multi-stage 避免工具链残留。
+    languages:
+      - dockerfile
+    pattern-either:
+      - pattern: |
+          RUN $CURL ...
+      - pattern: |
+          RUN $WGET ...
+    metadata:
+      cwe: "CWE-1104: Use of Unmaintained Third Party Components"
+      owasp: "A06:2021 - Vulnerable and Outdated Components"
+      precision: low
+      tags: [docker, image-size, supply-chain]
+
+  # ZM-IAC-DOCKER-003: USER root (未降权)
+  - id: zm-iac-docker-root-001
+    severity: MEDIUM
+    message: |
+      容器以 `root` 身份运行 — 容器逃逸后拥有宿主机 root 权限。
+      Dockerfile 末尾添加 `USER 1000` 切换到非 root 用户，
+      或 Kubernetes PodSecurityContext 设置 `runAsNonRoot: true`。
+    languages:
+      - dockerfile
+    pattern: |
+      USER root
+    pattern-not: |
+      USER $NONROOT
+    metadata:
+      cwe: "CWE-250: Execution with Unnecessary Privileges"
+      owasp: "A05:2021 - Security Misconfiguration"
+      precision: very-high
+      tags: [docker, privilege-escalation, root]
+
+  # ZM-IAC-DOCKER-004: COPY --chown 缺失（COPY 的文件以 root 拥有）
+  - id: zm-iac-docker-chown-001
+    severity: LOW
+    message: |
+      `COPY` 未使用 `--chown` — 文件默认为 `root:root` 拥有，非 root 用户无法读取。
+      使用 `COPY --chown=1000:1000 src/ dest/` 将文件所有权授予非 root 用户。
+    languages:
+      - dockerfile
+    pattern: |
+      COPY $SRC $DEST
+    pattern-not: |
+      COPY --chown=$OWNER $SRC $DEST
+    metadata:
+      cwe: "CWE-732: Incorrect Permission Assignment for Critical Resource"
+      owasp: "A05:2021 - Security Misconfiguration"
+      precision: low
+      tags: [docker, file-permission]
+
+  # ZM-IAC-DOCKER-005: EXPOSE 敏感端口
+  - id: zm-iac-docker-sensitive-port-001
+    severity: HIGH
+    message: |
+      EXPOSE 暴露了数据库/管理/调试端口 — 端口 22(SSH)/2375(Docker)/3306(MySQL)/5432(PostgreSQL)/
+      6379(Redis)/27017(MongoDB)/9200(ES)/9090(Prometheus) 不应直接对外。
+      仅 EXPOSE 业务端口 (80/443/8080)，敏感端口由内部网络或 sidecar 代理访问。
+    languages:
+      - dockerfile
+    pattern-either:
+      - pattern: EXPOSE 22
+      - pattern: EXPOSE 2375
+      - pattern: EXPOSE 3306
+      - pattern: EXPOSE 5432
+      - pattern: EXPOSE 6379
+      - pattern: EXPOSE 27017
+      - pattern: EXPOSE 9200
+      - pattern: EXPOSE 9090
+      - pattern: EXPOSE 9093
+      - pattern: EXPOSE 3000
+      - pattern: EXPOSE 5000
+      - pattern: EXPOSE 8000
+      - pattern: EXPOSE 8500
+    metadata:
+      cwe: "CWE-200: Exposure of Sensitive Information"
+      owasp: "A05:2021 - Security Misconfiguration"
+      precision: very-high
+      tags: [docker, network-exposure, sensitive-port]

package/rules/iac/zm-k8s-cwe200-service-account.yaml

@@ -0,0 +1,83 @@
+# 逐码 ZhuMa IaC 规则 — Kubernetes ServiceAccount 安全检测
+# V4.1 Sprint — CWE-200: Exposure of Sensitive Information
+# 检测: ServiceAccount未限制、automountServiceAccountToken未设false、cluster-admin绑定
+
+rules:
+  # ZM-K8S-CWE200-SA-001: ServiceAccount automountServiceAccountToken 未显式禁用
+  - id: zm-k8s-cwe200-sa-001
+    severity: MEDIUM
+    message: |
+      ServiceAccount 未设置 `automountServiceAccountToken: false` — 默认挂载API token到Pod中。
+      即使应用不需要访问K8s API，token仍然存在，权限逃逸后可调用API Server。
+
+      修复:
+      1. 在 ServiceAccount 或 Pod spec 中设置: `automountServiceAccountToken: false`
+      2. 仅向需要API访问的ServiceAccount授予最低权限
+      3. 使用Pod Security Admission限制 automountServiceAccountToken
+    languages:
+      - yaml
+    pattern: |
+      automountServiceAccountToken: true
+    metadata:
+      cwe: "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"
+      category: iac-kubernetes
+      precision: very-high
+      confidence: high
+      tags: [kubernetes, service-account, token-exposure, security-misconfiguration]
+
+  # ZM-K8S-CWE200-SA-002: ClusterRoleBinding 绑定到默认 ServiceAccount
+  - id: zm-k8s-cwe200-sa-002
+    severity: CRITICAL
+    message: |
+      ClusterRoleBinding 将 `cluster-admin` 或高危 ClusterRole 绑定到 `default` ServiceAccount
+      或命名空间级别的 ServiceAccount。这授予了集群范围的管理权限。
+
+      检查 subjects 中的 name 是否为 `default` 或非专用的 ServiceAccount。
+
+      修复:
+      1. 将 cluster-admin 绑定限制为仅系统组件和管理员账户
+      2. 为应用创建专用 ServiceAccount 并绑定最小权限 Role
+      3. 使用 RoleBinding(命名空间级)替代 ClusterRoleBinding(集群级)
+      4. 定期审计 ClusterRoleBinding/subjects
+    languages:
+      - yaml
+    pattern-either:
+      - pattern: |
+          subjects:
+          - kind: ServiceAccount
+            name: default
+      - pattern: |
+          subjects:
+            - kind: ServiceAccount
+              name: default
+      - pattern: |
+          subjects: [{kind: ServiceAccount, name: default}]
+    metadata:
+      cwe: "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"
+      category: iac-kubernetes
+      precision: very-high
+      confidence: high
+      tags: [kubernetes, clusterrole-binding, privilege-escalation, cluster-admin]
+
+  # ZM-K8S-CWE200-SA-003: Pod spec 中 ServiceAccount 名称为 default
+  - id: zm-k8s-cwe200-sa-003
+    severity: LOW
+    message: |
+      Pod 使用 `serviceAccountName: default` — 每个命名空间中的默认 ServiceAccount。
+      default ServiceAccount 可能已被授予不必要的权限。
+      应为每个应用创建专用 ServiceAccount 并授予最小权限。
+
+      修复:
+      1. 创建应用专用 ServiceAccount: `serviceAccountName: my-app`
+      2. 绑定最小权限 Role(非 cluster-admin)
+      3. 设置 `automountServiceAccountToken: false` 如不需要K8s API访问
+    languages:
+      - yaml
+    pattern: |
+      serviceAccountName: default
+    metadata:
+      cwe: "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"
+      category: iac-kubernetes
+      precision: very-high
+      confidence: high
+      tags: [kubernetes, service-account, best-practice, least-privilege]

package/rules/iac/zm-k8s-cwe250-privileged.yaml

@@ -0,0 +1,56 @@
+# 逐码 ZhuMa IaC 规则 — Kubernetes 特权容器深度检测
+# V4.1 Sprint — CWE-250: Execution with Unnecessary Privileges
+
+rules:
+  # ZM-K8S-CWE250-001: hostNetwork: true
+  - id: zm-k8s-cwe250-priv-001
+    severity: HIGH
+    message: |
+      Pod 启用 `hostNetwork: true` — 容器共享宿主机网络命名空间，可监听宿主机端口、嗅探网络流量。
+      除非是 CNI 插件或网络监控组件，否则应移除 `hostNetwork: true` 并使用 ClusterIP/NodePort 暴露服务。
+    languages:
+      - yaml
+    pattern: |
+      hostNetwork: true
+    metadata:
+      cwe: "CWE-250: Execution with Unnecessary Privileges"
+      category: iac-kubernetes
+      precision: very-high
+      confidence: high
+      tags: [kubernetes, hostNetwork, privilege-escalation, network-isolation]
+
+  # ZM-K8S-CWE250-002: hostPID: true
+  - id: zm-k8s-cwe250-priv-002
+    severity: CRITICAL
+    message: |
+      Pod 启用 `hostPID: true` — 容器可查看和操作宿主机上的所有进程，可通过 `/proc` 直接与主机进程交互。
+      这是一种极度危险的配置，攻击者可以利用它向主机进程注入恶意代码。
+      除非绝对必要（如 node-exporter 等监控组件），否则应移除 `hostPID: true`。
+    languages:
+      - yaml
+    pattern: |
+      hostPID: true
+    metadata:
+      cwe: "CWE-250: Execution with Unnecessary Privileges"
+      category: iac-kubernetes
+      precision: very-high
+      confidence: high
+      tags: [kubernetes, hostPID, privilege-escalation, process-injection]
+
+  # ZM-K8S-CWE250-003: hostIPC: true
+  - id: zm-k8s-cwe250-priv-003
+    severity: HIGH
+    message: |
+      Pod 启用 `hostIPC: true` — 容器可访问宿主机进程间通信 (IPC) 命名空间，包括共享内存段和信号量。
+      这允许容器与宿主机上其他进程通过共享内存交互，可能被利用进行权限提升攻击。
+      除非是特定的系统组件，否则应移除 `hostIPC: true`。
+    languages:
+      - yaml
+    pattern: |
+      hostIPC: true
+    metadata:
+      cwe: "CWE-250: Execution with Unnecessary Privileges"
+      category: iac-kubernetes
+      precision: very-high
+      confidence: high
+      tags: [kubernetes, hostIPC, privilege-escalation, ipc-namespace]

package/rules/iac/zm-k8s-security.yaml

@@ -0,0 +1,79 @@
+# 逐码 ZhuMa IaC 规则 — Kubernetes 安全检测
+# V4.1 Sprint 3 — 首批3条 K8s 最常见安全配置问题
+
+rules:
+  # ZM-IAC-K8S-001: runAsNonRoot 未设置
+  - id: zm-iac-k8s-nonroot-001
+    severity: HIGH
+    message: |
+      Pod/容器未设置 `runAsNonRoot: true` — 容器可以以 root 身份运行。
+      在 Pod securityContext 或 Container securityContext 中添加:
+      ```yaml
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+      ```
+    languages:
+      - yaml
+    pattern: |
+      containers:
+        - name: $NAME
+          image: $IMAGE
+    pattern-not: |
+      containers:
+        - name: $NAME
+          image: $IMAGE
+          securityContext:
+            ...
+            runAsNonRoot: $VAL
+    metadata:
+      cwe: "CWE-250: Execution with Unnecessary Privileges"
+      owasp: "A05:2021 - Security Misconfiguration"
+      precision: medium
+      tags: [kubernetes, privilege-escalation, securitycontext]
+
+  # ZM-IAC-K8S-002: privileged: true
+  - id: zm-iac-k8s-privileged-001
+    severity: CRITICAL
+    message: |
+      容器以 `privileged: true` 运行 — 该容器获得宿主机的所有 Linux Capabilities，
+      包括加载内核模块、访问所有设备。除非是系统级组件 (如 kube-proxy、CNI 插件)，
+      否则应移除 `privileged: true` 并使用细粒度 `capabilities` 声明。
+    languages:
+      - yaml
+    pattern: |
+      privileged: true
+    metadata:
+      cwe: "CWE-250: Execution with Unnecessary Privileges"
+      owasp: "A05:2021 - Security Misconfiguration"
+      precision: very-high
+      tags: [kubernetes, privileged-container, rce, escape]
+
+  # ZM-IAC-K8S-003: allowPrivilegeEscalation 未显式禁用
+  - id: zm-iac-k8s-allow-escalation-001
+    severity: MEDIUM
+    message: |
+      未显式设置 `allowPrivilegeEscalation: false` — 默认允许子进程获取比父进程更多的特权。
+      在容器 securityContext 中添加:
+      ```yaml
+      securityContext:
+        allowPrivilegeEscalation: false
+      ```
+    languages:
+      - yaml
+    pattern: |
+      containers:
+        - name: $NAME
+          image: $IMAGE
+    pattern-not: |
+      containers:
+        - name: $NAME
+          image: $IMAGE
+          securityContext:
+            ...
+            allowPrivilegeEscalation: $VAL
+    metadata:
+      cwe: "CWE-250: Execution with Unnecessary Privileges"
+      owasp: "A05:2021 - Security Misconfiguration"
+      precision: medium
+      tags: [kubernetes, privilege-escalation, securitycontext]