tools: Allow setting policy rego file via environment variable (#123)

* Set policy file via env var

* Add restrictive policy file to kata-opa folder

* Change restrictive policy file name

* Change relative default path location

src/kata-opa/allow-set-policy.rego

@@ -0,0 +1,3 @@
+package agent_policy
+
+default SetPolicyRequest := true

tests/integration/kubernetes/setup.sh

@@ -13,6 +13,7 @@ else
     K8S_TEST_POLICY_FILES=( \
         "allow-all.rego" \
         "allow-all-except-exec-process.rego" \
+        "allow-set-policy.rego" \
     )
 fi
 

tools/osbuilder/rootfs-builder/rootfs.sh

@@ -28,10 +28,13 @@ LIBC=${LIBC:-musl}
 SECCOMP=${SECCOMP:-"yes"}
 SELINUX=${SELINUX:-"no"}
 AGENT_POLICY=${AGENT_POLICY:-no}
+AGENT_POLICY_FILE=${AGENT_POLICY_FILE:-"allow-all.rego"}
 
 lib_file="${script_dir}/../scripts/lib.sh"
 source "$lib_file"
 
+agent_policy_file="$(readlink -f "${script_dir}/../../../src/kata-opa/${AGENT_POLICY_FILE}")"
+
 #For cross build
 CROSS_BUILD=${CROSS_BUILD:-false}
 BUILDX=""
@@ -113,6 +116,12 @@ AGENT_INIT          When set to "yes", use ${AGENT_BIN} as init process in place
                     of systemd.
                     Default value: no
 
+AGENT_POLICY_FILE   Path to the agent policy rego file to be set in the rootfs.
+                    If defined, this overwrites the default setting of the
+                    permissive policy file. The path is relative to the policy
+                    rego file directory 'src/kata-opa'.
+                    Default value: allow-all.rego
+
 AGENT_SOURCE_BIN    Path to the directory of agent binary.
                     If set, use the binary as agent but not build agent package.
                     Default value: <not set>
@@ -321,6 +330,8 @@ check_env_variables()
 
 	[ -n "${KERNEL_MODULES_DIR}" ] && [ ! -d "${KERNEL_MODULES_DIR}" ] && die "KERNEL_MODULES_DIR defined but is not an existing directory"
 
+	[ ! -f "${agent_policy_file}" ] && die "agent policy file not found in '${agent_policy_file}'"
+
 	[ -n "${OSBUILDER_VERSION}" ] || die "need osbuilder version"
 }
 
@@ -447,6 +458,7 @@ build_rootfs_distro()
 			--env ROOTFS_DIR="/rootfs" \
 			--env AGENT_BIN="${AGENT_BIN}" \
 			--env AGENT_INIT="${AGENT_INIT}" \
+			--env AGENT_POLICY_FILE="${AGENT_POLICY_FILE}" \
 			--env ARCH="${ARCH}" \
 			--env CI="${CI}" \
 			--env MEASURED_ROOTFS="${MEASURED_ROOTFS}" \
@@ -672,18 +684,18 @@ EOF
 		fi
 
 		# Install default settings for the kata-opa service.
-		local kata_opa_in_dir="${script_dir}/../../../src/kata-opa"
 		local opa_settings_dir="/etc/kata-opa"
-		local policy_file="allow-all.rego"
+		local policy_file_name="$(basename ${agent_policy_file})"
 		local policy_dir="${ROOTFS_DIR}/${opa_settings_dir}"
 		mkdir -p "${policy_dir}"
-		install -D -o root -g root -m 0644 "${kata_opa_in_dir}/${policy_file}" -T "${policy_dir}/${policy_file}"
-		ln -sf "${policy_file}" "${policy_dir}/default-policy.rego"
+		install -D -o root -g root -m 0644 "${agent_policy_file}" -T "${policy_dir}/${policy_file_name}"
+		ln -sf "${policy_file_name}" "${policy_dir}/default-policy.rego"
 
 		if [ "${AGENT_INIT}" == "yes" ]; then
 			info "OPA will be started by the kata agent"
 		else
 			# Install the unit file for the kata-opa service.
+			local kata_opa_in_dir="${script_dir}/../../../src/kata-opa"
 			local kata_opa_unit="kata-opa.service"
 			local kata_opa_unit_path="${ROOTFS_DIR}/usr/lib/systemd/system/${kata_opa_unit}"
 			local kata_containers_wants="${ROOTFS_DIR}/etc/systemd/system/kata-containers.target.wants"