Cannot exclude particular rules from Control

[RomanTheLegend]

Description

When applying posturePolicies for given control, the ruleName section doesn't seem to build proper list of rule exclusions, but rather applies all-or-nothing approach.

For example, for C-0211 control I want to scan for some rules like privileged container rule-privilege-escalation & immutable-container-filesystem, but don't scan for set-seLinuxOptions, drop-capability-netraw and few other rules.

According to the documentation, I should pass a map, but when I do that it excludes from scan even the rules I need - I took this as a reference:

https://github.com/kubescape/regolibrary/blob/e98a0d43c5c1d74da5233ce83e9afae9e86ffb9e/controls/C-0211-applysecuritycontexttoyourpodsandcontainers.json

{
    "name": "exclude-excessive-security-context",
    "policyType": "postureExceptionPolicy",
    "actions": [
        "alertOnly"
    ],
    "resources": [
        {
            "designatorType": "Attributes",
            "attributes": {
                "kind": ".*"
            }
        }
    ],
    "posturePolicies": [
        {
            "controlID": "C-0211",
            "ruleName": [
                "drop-capability-netraw",
                "set-seLinuxOptions",
                "set-seccomp-profile",
                "set-procmount-default",
                "set-sysctls-params",
                "set-supplementalgroups-values"
            ]
        }
    ]
}

Completely skips the control

On the other hand

{
    "name": "exclude-excessive-security-context",
    "policyType": "postureExceptionPolicy",
    "actions": [
        "alertOnly"
    ],
    "resources": [
        {
            "designatorType": "Attributes",
            "attributes": {
                "kind": ".*"
            }
        }
    ],
    "posturePolicies": [
        {
            "controlID": "C-0211",
            "ruleName": "drop-capability-netraw"
        },
        {
            "controlID": "C-0211",
            "ruleName": "set-seLinuxOptions"
        },
        {
            "controlID": "C-0211",
            "ruleName": "set-seccomp-profile"
        },
        {
            "controlID": "C-0211",
            "ruleName": "set-procmount-default"
        },
        {
            "controlID": "C-0211",
            "ruleName": "set-sysctls-params"
        },
        {
            "controlID": "C-0211",
            "ruleName": "set-supplementalgroups-values"
        }
    ]
}

Checks every rule regardless if it's on the list or not.

Could you please either provide an example of proper use or confirm this is a bug

https://github.com/kubescape/kubescape/tree/master/examples/exceptions

Kubescape v3.0.8

[matthyx]

hi @RomanTheLegend thanks for the report, we'll look at it very soon
cc @YiscahLevySilas1