vbatts/cri-o
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Merge pull request #547 from sameo/topic/privileged-paths

Browse source 
container: Do not restrict path access for privileged containers
This commit is contained in:
Mrunal Patel 2017-05-30 21:38:57 -07:00 committed by GitHub
commit b5153e08c5
1 changed files with 22 additions and 19 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
server/container_create.go
View file

@ -466,6 +466,8 @@ func (s *Server) createSandboxContainer(ctx context.Context, containerID string,
specgen.SetProcessSelinuxLabel(sb.processLabel) specgen.SetProcessSelinuxLabel(sb.processLabel)
specgen.SetLinuxMountLabel(sb.mountLabel) specgen.SetLinuxMountLabel(sb.mountLabel)
if containerConfig.GetLinux().GetSecurityContext() != nil &&
containerConfig.GetLinux().GetSecurityContext().Privileged == false {
for _, mp := range []string{ for _, mp := range []string{
"/proc/kcore", "/proc/kcore",
"/proc/latency_stats", "/proc/latency_stats",
@ -488,6 +490,7 @@ func (s *Server) createSandboxContainer(ctx context.Context, containerID string,
specgen.AddLinuxReadonlyPaths(rp) specgen.AddLinuxReadonlyPaths(rp)
} }
} }
}
// Join the namespace paths for the pod sandbox container. // Join the namespace paths for the pod sandbox container.
podInfraState := s.runtime.ContainerStatus(sb.infraContainer) podInfraState := s.runtime.ContainerStatus(sb.infraContainer)