vbatts/cri-o
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

container: Do not restrict path access for privileged containers

Browse source 
Privileged containers should see and reach all host paths.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
This commit is contained in:
Samuel Ortiz 2017-05-31 02:03:54 +02:00
parent 42d2fa6576
commit e23d986cf2
1 changed files with 22 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

41
server/container_create.go
View file

@ -466,26 +466,29 @@ func (s *Server) createSandboxContainer(ctx context.Context, containerID string,
specgen.SetProcessSelinuxLabel(sb.processLabel) specgen.SetProcessSelinuxLabel(sb.processLabel)
specgen.SetLinuxMountLabel(sb.mountLabel) specgen.SetLinuxMountLabel(sb.mountLabel)
for _, mp := range []string{ if containerConfig.GetLinux().GetSecurityContext() != nil &&
"/proc/kcore", containerConfig.GetLinux().GetSecurityContext().Privileged == false {
"/proc/latency_stats", for _, mp := range []string{
"/proc/timer_list", "/proc/kcore",
"/proc/timer_stats", "/proc/latency_stats",
"/proc/sched_debug", "/proc/timer_list",
"/sys/firmware", "/proc/timer_stats",
} { "/proc/sched_debug",
specgen.AddLinuxMaskedPaths(mp) "/sys/firmware",
} } {
specgen.AddLinuxMaskedPaths(mp)
}
for _, rp := range []string{ for _, rp := range []string{
"/proc/asound", "/proc/asound",
"/proc/bus", "/proc/bus",
"/proc/fs", "/proc/fs",
"/proc/irq", "/proc/irq",
"/proc/sys", "/proc/sys",
"/proc/sysrq-trigger", "/proc/sysrq-trigger",
} { } {
specgen.AddLinuxReadonlyPaths(rp) specgen.AddLinuxReadonlyPaths(rp)
}
} }
} }
// Join the namespace paths for the pod sandbox container. // Join the namespace paths for the pod sandbox container.