github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-10-31 13:50:01 +00:00
Code Issues Projects Releases Wiki Activity

check if kubelet is running as uid 0

Browse Source 
Signed-off-by: Vishnu kannan <vishnuk@google.com>
This commit is contained in:
Vishnu kannan
2016-08-11 11:59:59 -07:00
parent ac1f8bc665
commit c75b61ed48
1 changed files with 12 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
cmd/kubelet/app/server.go
View File

@@ -35,7 +35,6 @@ import (
"github.com/golang/glog" "github.com/golang/glog"
"github.com/spf13/cobra" "github.com/spf13/cobra"
"github.com/spf13/pflag" "github.com/spf13/pflag"
"github.com/syndtr/gocapability/capability"
"k8s.io/kubernetes/cmd/kubelet/app/options" "k8s.io/kubernetes/cmd/kubelet/app/options"
"k8s.io/kubernetes/pkg/api" "k8s.io/kubernetes/pkg/api"
@@ -300,10 +299,22 @@ func Run(s *options.KubeletServer, kcfg *KubeletConfig) error {
return err return err
} }
func checkPermissions() error {
if uid := os.Getuid(); uid != 0 {
return fmt.Errorf("Kubelet needs to run as uid `0`. It is being run as %d", uid)
}
// TODO: Check if kubelet is running in the `initial` user namespace.
// http://man7.org/linux/man-pages/man7/user_namespaces.7.html
return nil
}
func run(s *options.KubeletServer, kcfg *KubeletConfig) (err error) { func run(s *options.KubeletServer, kcfg *KubeletConfig) (err error) {
if s.ExitOnLockContention && s.LockFilePath == "" { if s.ExitOnLockContention && s.LockFilePath == "" {
return errors.New("cannot exit on lock file contention: no lock file specified") return errors.New("cannot exit on lock file contention: no lock file specified")
} }
if err := checkPermissions(); err != nil {
glog.Error(err)
}
done := make(chan struct{}) done := make(chan struct{})
if s.LockFilePath != "" { if s.LockFilePath != "" {
@@ -324,15 +335,6 @@ func run(s *options.KubeletServer, kcfg *KubeletConfig) (err error) {
glog.Errorf("unable to register configz: %s", err) glog.Errorf("unable to register configz: %s", err)
} }
// check if we have CAP_SYS_ADMIN to setgroup properly
pid, err := capability.NewPid(os.Getpid())
if err != nil {
return err
}
if !pid.Get(capability.EFFECTIVE, capability.CAP_SYS_ADMIN) {
return fmt.Errorf("Kubelet needs the CAP_SYS_ADMIN capability. Please run kubelet as root or in a privileged container")
}
if kcfg == nil { if kcfg == nil {
cfg, err := UnsecuredKubeletConfig(s) cfg, err := UnsecuredKubeletConfig(s)
if err != nil { if err != nil {