From 37963de155119b3450fdec47ab99014e568f0418 Mon Sep 17 00:00:00 2001
From: Kjeld Schouten-Lebbing <kjeld@schouten-lebbing.nl>
Date: Sat, 25 Sep 2021 15:11:51 +0200
Subject: [PATCH] Add ReadOnlyRoot mitigation for S6 overlay (#1030)

* Add ReadOnlyRoot mitigation for S6 overlay

* try to fix some tests
---
 charts/library/common/Chart.yaml                |  2 +-
 .../templates/lib/controller/_container.tpl     |  4 ++++
 charts/library/common/tests/container_test.go   | 17 +++++++++--------
 3 files changed, 14 insertions(+), 9 deletions(-)

diff --git a/charts/library/common/Chart.yaml b/charts/library/common/Chart.yaml
index 8253b4a287d..5894c069d69 100644
--- a/charts/library/common/Chart.yaml
+++ b/charts/library/common/Chart.yaml
@@ -15,4 +15,4 @@ maintainers:
 name: common
 sources: null
 type: library
-version: 8.0.1
+version: 8.0.2
diff --git a/charts/library/common/templates/lib/controller/_container.tpl b/charts/library/common/templates/lib/controller/_container.tpl
index 64fca9938b6..9f50fabc9e5 100644
--- a/charts/library/common/templates/lib/controller/_container.tpl
+++ b/charts/library/common/templates/lib/controller/_container.tpl
@@ -35,6 +35,10 @@
   {{- end }}
 
   env:
+   {{- if .Values.securityContext.readOnlyRootFilesystem }}
+    - name: S6_READ_ONLY_ROOT
+      value: "1"
+   {{- end }}
    {{- range $key, $value := .Values.envTpl }}
     - name: {{ $key }}
       value: {{ tpl $value $ | quote }}
diff --git a/charts/library/common/tests/container_test.go b/charts/library/common/tests/container_test.go
index c06faab0bf9..f6893099e3e 100644
--- a/charts/library/common/tests/container_test.go
+++ b/charts/library/common/tests/container_test.go
@@ -98,14 +98,14 @@ func (suite *ContainerTestSuite) TestEnv() {
         values      []string
         expectedEnv map[string]string
     }{
-        "Default":                    {values: nil, expectedEnv: nil},
-        "KeyValueString":             {values: []string{"env.string=value_of_env"}, expectedEnv: map[string]string{"string": "value_of_env"}},
-        "KeyValueFloat":              {values: []string{"env.float=4.2"}, expectedEnv: map[string]string{"float": "4.2"}},
-        "KeyValueBool":               {values: []string{"env.bool=false"}, expectedEnv: map[string]string{"bool": "false"}},
-        "KeyValueInt":                {values: []string{"env.int=42"}, expectedEnv: map[string]string{"int": "42"}},
-        "KeyValue+ExplicitValueFrom": {values: []string{"env.STATIC_ENV=value_of_env", "env.STATIC_ENV_FROM.valueFrom.fieldRef.fieldPath=spec.nodeName"}, expectedEnv: map[string]string{"STATIC_ENV": "value_of_env", "STATIC_ENV_FROM": "spec.nodeName"}},
-        "ImplicitValueFrom":          {values: []string{"env.NODE_NAME.fieldRef.fieldPath=spec.nodeName"}, expectedEnv: map[string]string{"NODE_NAME": "spec.nodeName"}},
-        "Templated":                  {values: []string{`env.DYN_ENV=\{\{ .Release.Name \}\}-admin`}, expectedEnv: map[string]string{"DYN_ENV": "common-test-admin"}},
+        "Default":                    {values: nil, expectedEnv: map[string]string{"S6_READ_ONLY_ROOT":"1"}},
+        "KeyValueString":             {values: []string{"env.string=value_of_env"}, expectedEnv: map[string]string{"S6_READ_ONLY_ROOT":"1", "string": "value_of_env"}},
+        "KeyValueFloat":              {values: []string{"env.float=4.2"}, expectedEnv: map[string]string{"S6_READ_ONLY_ROOT":"1", "float": "4.2"}},
+        "KeyValueBool":               {values: []string{"env.bool=false"}, expectedEnv: map[string]string{"S6_READ_ONLY_ROOT":"1", "bool":"false"}},
+        "KeyValueInt":                {values: []string{"env.int=42"}, expectedEnv: map[string]string{"S6_READ_ONLY_ROOT":"1", "int": "42"}},
+        "KeyValue+ExplicitValueFrom": {values: []string{"env.STATIC_ENV=value_of_env", "env.STATIC_ENV_FROM.valueFrom.fieldRef.fieldPath=spec.nodeName"}, expectedEnv: map[string]string{"S6_READ_ONLY_ROOT":"1", "STATIC_ENV": "value_of_env", "STATIC_ENV_FROM": "spec.nodeName"}},
+        "ImplicitValueFrom":          {values: []string{"env.NODE_NAME.fieldRef.fieldPath=spec.nodeName"}, expectedEnv: map[string]string{"NODE_NAME": "spec.nodeName", "S6_READ_ONLY_ROOT":"1"}},
+        "Templated":                  {values: []string{`env.DYN_ENV=\{\{ .Release.Name \}\}-admin`}, expectedEnv: map[string]string{"DYN_ENV": "common-test-admin", "S6_READ_ONLY_ROOT":"1"}},
         "Mixed": {
             values: []string{
                 `env.DYN_ENV=\{\{ .Release.Name \}\}-admin`,
@@ -115,6 +115,7 @@ func (suite *ContainerTestSuite) TestEnv() {
             },
             expectedEnv: map[string]string{
                 "DYN_ENV":                  "common-test-admin",
+                "S6_READ_ONLY_ROOT":        "1", "
                 "STATIC_ENV":               "value_of_env",
                 "STATIC_EXPLICIT_ENV_FROM": "spec.nodeName",
                 "STATIC_IMPLICIT_ENV_FROM": "spec.nodeName",