vbatts/cri-o
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

container_create: set privileged on ctr only if also on sandbox

Browse source 
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
This commit is contained in:
Antonio Murdaca 2017-09-06 16:36:53 +02:00
parent dacc5c3ece
commit cde40ad5ca
No known key found for this signature in database
GPG key ID: B2BEAD150DE936B9
1 changed files with 3 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
server/container_create.go
View file

@ -419,6 +419,9 @@ func (s *Server) createSandboxContainer(ctx context.Context, containerID string,
var readOnlyRootfs bool
if containerConfig.GetLinux().GetSecurityContext() != nil {
if containerConfig.GetLinux().GetSecurityContext().Privileged {
if !sb.Privileged() {
return nil, fmt.Errorf("no privileged container allowed in sandbox")
}
specgen.SetupPrivileged(true)
}