Merge pull request #547 from sameo/topic/privileged-paths
container: Do not restrict path access for privileged containers
This commit is contained in:
commit
b5153e08c5
1 changed files with 22 additions and 19 deletions
|
@ -466,6 +466,8 @@ func (s *Server) createSandboxContainer(ctx context.Context, containerID string,
|
|||
specgen.SetProcessSelinuxLabel(sb.processLabel)
|
||||
specgen.SetLinuxMountLabel(sb.mountLabel)
|
||||
|
||||
if containerConfig.GetLinux().GetSecurityContext() != nil &&
|
||||
containerConfig.GetLinux().GetSecurityContext().Privileged == false {
|
||||
for _, mp := range []string{
|
||||
"/proc/kcore",
|
||||
"/proc/latency_stats",
|
||||
|
@ -488,6 +490,7 @@ func (s *Server) createSandboxContainer(ctx context.Context, containerID string,
|
|||
specgen.AddLinuxReadonlyPaths(rp)
|
||||
}
|
||||
}
|
||||
}
|
||||
// Join the namespace paths for the pod sandbox container.
|
||||
podInfraState := s.runtime.ContainerStatus(sb.infraContainer)
|
||||
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue