github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-08-11 13:02:14 +00:00
Code Issues Projects Releases Wiki Activity

reject pod creation for hostNet pod with net sysctl; hostIPC pod with ipc sysctl

Browse Source 
Signed-off-by: Paco Xu <paco.xu@daocloud.io>
This commit is contained in:
Paco Xu 2023-06-16 14:45:36 +08:00
parent 1aef58b72a
commit 4321652d13
1 changed files with 17 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
pkg/apis/core/validation/validation.go
View File

@ -4562,7 +4562,7 @@ func IsValidSysctlName(name string) bool {
return sysctlContainSlashRegexp.MatchString(name)
}
func validateSysctls(sysctls []core.Sysctl, fldPath *field.Path) field.ErrorList {
func validateSysctls(sysctls []core.Sysctl, fldPath *field.Path, hostNetwork, hostIPC bool) field.ErrorList {
allErrs := field.ErrorList{}
names := make(map[string]struct{})
for i, s := range sysctls {
@ -4573,6 +4573,15 @@ func validateSysctls(sysctls []core.Sysctl, fldPath *field.Path) field.ErrorList
} else if _, ok := names[s.Name]; ok {
allErrs = append(allErrs, field.Duplicate(fldPath.Index(i).Child("name"), s.Name))
}
// The parameters hostNet and hostIPC are used to forbid sysctls for pod sharing the
// respective namespaces with the host.
if hostNetwork && strings.HasPrefix(s.Name, "net") {
allErrs = append(allErrs, field.Invalid(fldPath.Index(i).Child("name"), s.Name, "sysctl not allowed with host net enabled"))
}
if hostIPC && strings.HasPrefix(s.Name, "ipc") {
allErrs = append(allErrs, field.Invalid(fldPath.Index(i).Child("name"), s.Name, "sysctl not allowed with host ipc enabled"))
}
names[s.Name] = struct{}{}
}
return allErrs
@ -4610,7 +4619,13 @@ func validatePodSpecSecurityContext(securityContext *core.PodSecurityContext, sp
}
if len(securityContext.Sysctls) != 0 {
allErrs = append(allErrs, validateSysctls(securityContext.Sysctls, fldPath.Child("sysctls"))...)
var hostNetwork, hostIPC bool
if spec.SecurityContext != nil {
hostNetwork = spec.SecurityContext.HostNetwork
hostIPC = spec.SecurityContext.HostIPC
}
allErrs = append(allErrs, validateSysctls(securityContext.Sysctls, fldPath.Child("sysctls"), hostNetwork, hostIPC)...)
}
if securityContext.FSGroupChangePolicy != nil {