E-RBA
rbac-police
Evaluates a cluster's effective RBAC permissions against a Rego policy library to flag identities with real, documented privilege-escalation paths.
OVERVIEW
rbac-police (PaloAltoNetworks/rbac-police) goes a step past listing permissions: it collects the effective RBAC grants for every identity in a cluster — service accounts, users, groups — and evaluates them against a bundled library of over 20 Rego policies, each modeling a specific, documented Kubernetes privilege-escalation or lateral-movement path, such as a service account that can create pods with an arbitrary service account attached, or one that can read all secrets cluster-wide.
Because it separates data collection (collect) from evaluation (eval), the same RBAC snapshot can be re-evaluated against updated policies or filtered by severity and namespace without re-querying a live cluster, and its expand command answers the reverse question — given one specific identity, what its full accumulated grant from all its bindings actually adds up to.
USE CASES
Practical use cases
- 01
Running a cluster-wide sweep for the small number of RBAC grants that map to real, documented escalation paths, rather than reading every RoleBinding manually.
- 02
Filtering results by severity (-s High) to prioritize the few identities worth reporting first in a time-boxed engagement.
- 03
Using expand on a specific service account or user found elsewhere in the engagement to see its full, accumulated effective permissions.
- 04
Re-running an evaluation against a previously collected RBAC snapshot (collect then eval) to avoid repeated live queries against a sensitive production cluster.
QUICK START
For a cluster-wide RBAC sweep that prioritizes the small number of grants matching a documented escalation path, instead of reading every binding by hand.
- Confirm the credential used to run it can list RBAC objects (Roles, ClusterRoles, and their bindings) cluster-wide, or collect a snapshot for offline evaluation instead.
- Download a release binary — the project is archived, but the binaries and Rego policy library still run against current clusters.
- Run eval against the bundled policy library, optionally scoped by namespace or severity.
- Investigate each flagged identity with expand to confirm the accumulated permission is real before including it in the report.
rbac-police eval lib/ -s HighBEFORE YOU RUN IT
What to check before running it
The GitHub repository is archived and no longer actively maintained by Palo Alto Networks — the policy library covers well-known escalation paths as of its last update, so cross-check findings against newly published techniques it will not know about.
A policy hit reflects what RBAC alone permits; whether it is actually reachable still depends on the cluster's admission controllers and network policy, which rbac-police does not model — verify exploitability before reporting a finding as critical.
Running collect cluster-wide requires broad read access to RBAC objects; on a client's production cluster, prefer a scoped, read-only credential and confirm the resulting snapshot is handled under the engagement's data-handling agreement.