From 9dad3fc50bc6b1d60c44eeb0deb660407d35fe8d Mon Sep 17 00:00:00 2001 From: Slava Semushin Date: Tue, 19 Sep 2017 18:27:44 +0200 Subject: [PATCH] Modify nonroot, hostaccess, and hostmount-anyuid SCCs to drop some capabilities. - nonroot drops KILL, MKNOD, SETUID, and SETGID - hostaccess drops KILL, MKNOD, SETUID, and SETGID - hostmount-anyuid drops MKNOD --- pkg/cmd/server/bootstrappolicy/securitycontextconstraints.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkg/cmd/server/bootstrappolicy/securitycontextconstraints.go b/pkg/cmd/server/bootstrappolicy/securitycontextconstraints.go index d47d148cbee3..5dad66c6341f 100644 --- a/pkg/cmd/server/bootstrappolicy/securitycontextconstraints.go +++ b/pkg/cmd/server/bootstrappolicy/securitycontextconstraints.go @@ -114,6 +114,7 @@ func GetBootstrapSecurityContextConstraints(sccNameToAdditionalGroups map[string SupplementalGroups: securityapi.SupplementalGroupsStrategyOptions{ Type: securityapi.SupplementalGroupsStrategyRunAsAny, }, + RequiredDropCapabilities: []kapi.Capability{"KILL", "MKNOD", "SETUID", "SETGID"}, }, // SecurityContextConstraintHostMountAndAnyUID is the same as the restricted scc but allows the use of the hostPath and NFS plugins, and running as any UID. // Used by the PV recycler. @@ -143,6 +144,7 @@ func GetBootstrapSecurityContextConstraints(sccNameToAdditionalGroups map[string SupplementalGroups: securityapi.SupplementalGroupsStrategyOptions{ Type: securityapi.SupplementalGroupsStrategyRunAsAny, }, + RequiredDropCapabilities: []kapi.Capability{"MKNOD"}, }, // SecurityContextConstraintHostNS allows access to everything except privileged on the host // but still allocates UIDs and SELinux. @@ -176,6 +178,7 @@ func GetBootstrapSecurityContextConstraints(sccNameToAdditionalGroups map[string SupplementalGroups: securityapi.SupplementalGroupsStrategyOptions{ Type: securityapi.SupplementalGroupsStrategyRunAsAny, }, + RequiredDropCapabilities: []kapi.Capability{"KILL", "MKNOD", "SETUID", "SETGID"}, }, // SecurityContextConstraintRestricted allows no host access and allocates UIDs and SELinux. {