github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-31 23:37:01 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #90949 from pjbgf/seccomp-least-priv-kuberuntime

Browse Source 
Add seccomp least privilege for kuberuntime
This commit is contained in:
Kubernetes Prow Robot 2020-07-14 04:35:21 -07:00 committed by GitHub
commit 428b500c5a
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 16 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
pkg/kubelet/kuberuntime/kuberuntime_sandbox.go
View File

@ -148,8 +148,11 @@ func (m *kubeGenericRuntimeManager) generatePodSandboxLinuxConfig(pod *v1.Pod) (
lc := &runtimeapi.LinuxPodSandboxConfig{
CgroupParent: cgroupParent,
SecurityContext: &runtimeapi.LinuxSandboxSecurityContext{
Privileged: kubecontainer.HasPrivilegedContainer(pod),
SeccompProfilePath: m.getSeccompProfile(pod.Annotations, "", pod.Spec.SecurityContext, nil),
Privileged: kubecontainer.HasPrivilegedContainer(pod),
// Forcing sandbox to run as `runtime/default` allow users to
// use least privileged seccomp profiles at pod level. Issue #84623
SeccompProfilePath: v1.SeccompProfileRuntimeDefault,
},
}

30
pkg/kubelet/kuberuntime/kuberuntime_sandbox_test.go
View File

@ -67,37 +67,29 @@ func TestGeneratePodSandboxLinuxConfigSeccomp(t *testing.T) {
expectedProfile string
}{
{
description: "no seccomp defined at pod level should return empty",
pod: newSeccompPod(nil, nil, "", ""),
expectedProfile: "",
description: "no seccomp defined at pod level should return runtime/default",
pod: newSeccompPod(nil, nil, "", "runtime/default"),
expectedProfile: "runtime/default",
},
{
description: "seccomp field defined at pod level should be honoured",
pod: newSeccompPod(&v1.SeccompProfile{Type: v1.SeccompProfileTypeRuntimeDefault}, nil, "", ""),
description: "seccomp field defined at pod level should not be honoured",
pod: newSeccompPod(&v1.SeccompProfile{Type: v1.SeccompProfileTypeUnconfined}, nil, "", ""),
expectedProfile: "runtime/default",
},
{
description: "seccomp field defined at container level should not be honoured",
pod: newSeccompPod(nil, &v1.SeccompProfile{Type: v1.SeccompProfileTypeRuntimeDefault}, "", ""),
expectedProfile: "",
pod: newSeccompPod(nil, &v1.SeccompProfile{Type: v1.SeccompProfileTypeUnconfined}, "", ""),
expectedProfile: "runtime/default",
},
{
description: "seccomp annotation defined at pod level should be honoured",
pod: newSeccompPod(nil, nil, v1.SeccompProfileRuntimeDefault, ""),
description: "seccomp annotation defined at pod level should not be honoured",
pod: newSeccompPod(nil, nil, "unconfined", ""),
expectedProfile: "runtime/default",
},
{
description: "seccomp annotation defined at container level should not be honoured",
pod: newSeccompPod(nil, nil, "", v1.SeccompProfileRuntimeDefault),
expectedProfile: "",
},
{
description: "prioritise pod field over pod annotation",
pod: newSeccompPod(&v1.SeccompProfile{
Type: v1.SeccompProfileTypeLocalhost,
LocalhostProfile: pointer.StringPtr("pod-field"),
}, nil, "localhost/pod-annotation", ""),
expectedProfile: "localhost/" + filepath.Join(fakeSeccompProfileRoot, "pod-field"),
pod: newSeccompPod(nil, nil, "", "unconfined"),
expectedProfile: "runtime/default",
},
}