AI-written code implemented a six-capability denylist omitting SYS_TIME, letting tenants add it and bypass PodSpec safety validation.

+Licensed under the Apache License, Version 2.0 (the "License");+you may not use this file except in compliance with the License.+You may obtain a copy of the License at++    http://www.apache.org/licenses/LICENSE-2.0++Unless required by applicable law or agreed to in writing, software+distributed under the License is distributed on an "AS IS" BASIS,+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.+See the License for the specific language governing permissions and+limitations under the License.+*/++package v1++import (+	"errors"+	"fmt"+

+	"DAC_READ_SEARCH": {},+	"DAC_OVERRIDE":    {},+}++// ValidatePodSpecSafety rejects PodSpec fields that would let a low-privilege+// tenant escalate to host or cluster level when the executor or buildermgr+// schedules a pod from a user-supplied podspec.+//+// The fission-executor and fission-builder service accounts have the+// authority to create Deployments and Pods, so any field that crosses+// the container sandbox boundary (host namespaces, privileged contexts,+// hostPath mounts, alternate service accounts, dangerous capabilities)+// would let a Function- or Environment-CRUD tenant escape the boundary+// of their own RBAC and reach node-level state.+//+// Closes GHSA-gx55-f84r-v3r7, GHSA-wmgg-3p4h-48x7, GHSA-v455-mv2v-5g92.+//+// The fieldPath argument is used as a prefix in error messages so the+// caller can identify which podspec failed (e.g.+// "Environment.spec.runtime.podspec" / "Function.spec.podspec").+func ValidatePodSpecSafety(fieldPath string, ps *apiv1.PodSpec) error {+	if ps == nil {+		return nil+	}+	var errs error++	if ps.HostNetwork {+		errs = errors.Join(errs, fmt.Errorf("%s.hostNetwork is not allowed", fieldPath))+	}+	if ps.HostPID {+		errs = errors.Join(errs, fmt.Errorf("%s.hostPID is not allowed", fieldPath))+	}+	if ps.HostIPC {+		errs = errors.Join(errs, fmt.Errorf("%s.hostIPC is not allowed", fieldPath))+	}+	if ps.ServiceAccountName != "" {+		errs = errors.Join(errs, fmt.Errorf("%s.serviceAccountName override is not allowed", fieldPath))+	}+	for i, v := range ps.Volumes {+		if v.HostPath != nil {+			errs = errors.Join(errs, fmt.Errorf("%s.volumes[%d].hostPath (%q) is not allowed", fieldPath, i, v.Name))+		}+	}++	checkContainer := func(group string, c apiv1.Container) error {+		var cerrs error+		sc := c.SecurityContext+		if sc == nil {+			return nil+		}+		if sc.Privileged != nil && *sc.Privileged {+			cerrs = errors.Join(cerrs, fmt.Errorf(+				"%s.%s[%s].securityContext.privileged=true is not allowed", fieldPath, group, c.Name))+		}+		if sc.AllowPrivilegeEscalation != nil && *sc.AllowPrivilegeEscalation {+			cerrs = errors.Join(cerrs, fmt.Errorf(

@@ -117,3 +118,63 @@ func TestFunctionWebhook_Validate_CrossNamespacePackage(t *testing.T) { 		}) 	} }++// TestFunctionWebhook_Validate_RejectsDangerousPodSpec exercises the+// container-executor PodSpec safety check. Closes GHSA-v455-mv2v-5g92.+func TestFunctionWebhook_Validate_RejectsDangerousPodSpec(t *testing.T) {+	on := true+	cases := []struct {+		name      string+		ps        *apiv1.PodSpec+		wantInErr string+	}{+		{+			name:      "hostNetwork",+			ps:        &apiv1.PodSpec{HostNetwork: true},+			wantInErr: "hostNetwork",+		},+		{+			name: "hostPath volume",+			ps: &apiv1.PodSpec{+				Volumes: []apiv1.Volume{{+					Name: "host-root",+					VolumeSource: apiv1.VolumeSource{+						HostPath: &apiv1.HostPathVolumeSource{Path: "/"},+					},+				}},+			},+			wantInErr: "hostPath",+		},+		{+			name: "privileged container",+			ps: &apiv1.PodSpec{+				Containers: []apiv1.Container{{+					Name:            "user",+					SecurityContext: &apiv1.SecurityContext{Privileged: &on},+				}},+			},+			wantInErr: "privileged",+		},+		{+			name:      "serviceAccountName override",+			ps:        &apiv1.PodSpec{ServiceAccountName: "cluster-admin"},+			wantInErr: "serviceAccountName",+		},+	}++	r := &Function{}+	for _, tc := range cases {+		t.Run(tc.name, func(t *testing.T) {+			fn := makeValidFunction("default", "default", "default")+			fn.Spec.InvokeStrategy.ExecutionStrategy.ExecutorType = v1.ExecutorTypeContainer+			fn.Spec.PodSpec = tc.ps+			err := r.Validate(fn)+			if err == nil {+				t.Fatalf("expected rejection for %s, got nil", tc.name)+			}+			if !strings.Contains(err.Error(), tc.wantInErr) {+				t.Fatalf("error must mention %q, got: %v", tc.wantInErr, err)+			}+		})+	}+}

+you may not use this file except in compliance with the License.+You may obtain a copy of the License at++    http://www.apache.org/licenses/LICENSE-2.0+*/++package v1++import (+	"strings"+	"testing"++	apiv1 "k8s.io/api/core/v1"+)++func TestValidatePodSpecSafety_Nil(t *testing.T) {+	if err := ValidatePodSpecSafety("Function.spec.podspec", nil); err != nil {+		t.Fatalf("nil podspec must be accepted, got: %v", err)+	}+}++func TestValidatePodSpecSafety_Benign(t *testing.T) {+	allow := false+	ps := &apiv1.PodSpec{+		Containers: []apiv1.Container{{+			Name:    "user",+			Image:   "alpine:3.19",+			Command: []string{"/bin/sh", "-c", "echo hi"},+			Env:     []apiv1.EnvVar{{Name: "FOO", Value: "bar"}},+			SecurityContext: &apiv1.SecurityContext{+				AllowPrivilegeEscalation: &allow,+				Capabilities: &apiv1.Capabilities{+					Add: []apiv1.Capability{"NET_BIND_SERVICE"},+				},+			},+		}},+		Volumes: []apiv1.Volume{{+			Name: "cm",+			VolumeSource: apiv1.VolumeSource{+				ConfigMap: &apiv1.ConfigMapVolumeSource{+					LocalObjectReference: apiv1.LocalObjectReference{Name: "my-cm"},+				},+			},+		}},+		NodeSelector: map[string]string{"role": "fn"},+	}+	if err := ValidatePodSpecSafety("Function.spec.podspec", ps); err != nil {+		t.Fatalf("benign podspec must be accepted, got: %v", err)+	}+}++func TestValidatePodSpecSafety_DangerousFields(t *testing.T) {+	on := true+	cases := []struct {+		name      string+		mutate    func(*apiv1.PodSpec)+		wantInErr string+	}{+		{+			name:      "hostNetwork",+			mutate:    func(ps *apiv1.PodSpec) { ps.HostNetwork = true },+			wantInErr: "hostNetwork",+		},+		{+			name:      "hostPID",+			mutate:    func(ps *apiv1.PodSpec) { ps.HostPID = true },+			wantInErr: "hostPID",+		},+		{+			name:      "hostIPC",+			mutate:    func(ps *apiv1.PodSpec) { ps.HostIPC = true },+			wantInErr: "hostIPC",+		},+		{+			name:      "serviceAccountName override",+			mutate:    func(ps *apiv1.PodSpec) { ps.ServiceAccountName = "cluster-admin" },+			wantInErr: "serviceAccountName",+		},+		{+			name: "hostPath volume",+			mutate: func(ps *apiv1.PodSpec) {+				ps.Volumes = []apiv1.Volume{{+					Name: "host-root",+					VolumeSource: apiv1.VolumeSource{+						HostPath: &apiv1.HostPathVolumeSource{Path: "/"},

-// dangerousCapabilities lists Linux capabilities that effectively grant root-// or break the container sandbox. Tenants that can write to Environment or-// Function PodSpec must not be able to add these via securityContext.-var dangerousCapabilities = map[apiv1.Capability]struct{}{-	"SYS_ADMIN":       {},-	"NET_ADMIN":       {},-	"SYS_PTRACE":      {},

+// NET_ADMIN, SYS_PTRACE, SYS_MODULE, DAC_READ_SEARCH, DAC_OVERRIDE). The+// denylist was structurally incomplete: it omitted at least SYS_TIME (which

@@ -117,9 +121,10 @@ func ValidateContainerSafety(fieldPath string, c *apiv1.Container) error { 	}

 	}

-// dangerousMergeContainerCapabilities lists the Linux capabilities that-// effectively bypass the container sandbox. Kept in sync with the-// authoritative denylist in pkg/apis/core/v1/podspec_safety.go — the-// admission webhook is the primary defence; this is the merge-layer-// belt-and-braces for webhook-bypass clusters.-var dangerousMergeContainerCapabilities = map[apiv1.Capability]struct{}{-	"SYS_ADMIN":       {},-	"NET_ADMIN":       {},-	"SYS_PTRACE":      {},

-// of a container's SecurityContext after a MergePodSpec call. The merge-// path uses mergo.WithOverride and unconditionally copies SecurityContext-// fields from the target container, so a tenant-supplied podspec with-// privileged=true / allowPrivilegeEscalation=true / Capabilities.Add =-// [SYS_ADMIN, ...] would otherwise reach the running pod on-// webhook-bypass clusters (failurePolicy=Ignore or stale objects from a-// pre-webhook upgrade). The webhook is the primary defence; this is-// defence in depth. Closes GHSA-gx55-f84r-v3r7 / GHSA-wmgg-3p4h-48x7 /-// GHSA-v455-mv2v-5g92.

+//+// Closes GHSA-gx55-f84r-v3r7 / GHSA-wmgg-3p4h-48x7 / GHSA-v455-mv2v-5g92 and+// the follow-up GHSA-qf5v-m7p4-95rp (the prior denylist on capabilities.add+// could not enumerate every dangerous capability — the allowlist closes the+// demonstrated CAP_SYS_TIME bypass and every other non-allowlisted add).+//+// Not addressed here: the OCI runtime's ~14 default capabilities (MKNOD,+// SETFCAP, DAC_OVERRIDE, NET_RAW, ...) still reach the container. Forcing+// capabilities.drop=["ALL"] is the structural fix the qf5v advisory+// recommends, but Fission's own sidecar containers (fetcher, builder) were+// authored against the OCI default cap set and need to be audited before+// drop:["ALL"] can be applied uniformly. Tracked separately. func sanitizeContainerSecurityContext(c *apiv1.Container) { 	if c.SecurityContext == nil { 		return@@ -379,7 +383,7 @@ func sanitizeContainerSecurityContext(c *apiv1.Container) { 	if sc.Capabilities != nil && len(sc.Capabilities.Add) > 0 {