🔨 Remove CHECKPOINT_RESTORE capability from defaults

kubeshark · Feb 26, 2024 · 8fe0544 · 8fe0544
1 parent 09afa19
commit 8fe0544
Show file tree

Hide file tree

Showing 4 changed files with 0 additions and 9 deletions.
diff --git a/config/configStruct.go b/config/configStruct.go
@@ -41,8 +41,6 @@ func CreateDefaultConfig() ConfigStruct {
 					"SYS_PTRACE",
 					// DAC_OVERRIDE is required to read /proc/PID/environ
 					"DAC_OVERRIDE",
-					// CHECKPOINT_RESTORE is required to readlink /proc/PID/exe (kernel > 5.9)
-					"CHECKPOINT_RESTORE",
 				},
 				KernelModule: []string{
 					// SYS_MODULE is required to install kernel modules
@@ -55,8 +53,6 @@ func CreateDefaultConfig() ConfigStruct {
 					"SYS_PTRACE",
 					// SYS_RESOURCE is required to change rlimits for eBPF
 					"SYS_RESOURCE",
-					// CHECKPOINT_RESTORE is required to readlink /proc/PID/exe (kernel > 5.9)
-					"CHECKPOINT_RESTORE",
 					// IPC_LOCK is required for ebpf perf rings (kernel > )
 					"IPC_LOCK",
 				},

diff --git a/helm-chart/templates/14-openshift-security-context-constraints.yaml b/helm-chart/templates/14-openshift-security-context-constraints.yaml
@@ -27,7 +27,6 @@ allowedCapabilities:
   - SYS_PTRACE
   - DAC_OVERRIDE
   - SYS_RESOURCE
-  - CHECKPOINT_RESTORE
   - SYS_MODULE
 runAsUser:
   type: RunAsAny

diff --git a/helm-chart/values.yaml b/helm-chart/values.yaml
@@ -97,14 +97,12 @@ tap:
     - SYS_ADMIN
     - SYS_PTRACE
     - DAC_OVERRIDE
-    - CHECKPOINT_RESTORE
     kernelModule:
     - SYS_MODULE
     ebpfCapture:
     - SYS_ADMIN
     - SYS_PTRACE
     - SYS_RESOURCE
-    - CHECKPOINT_RESTORE
     - IPC_LOCK
   globalFilter: ""
   metrics:

diff --git a/manifests/complete.yaml b/manifests/complete.yaml
@@ -425,7 +425,6 @@ spec:
                 - SYS_ADMIN
                 - SYS_PTRACE
                 - DAC_OVERRIDE
-                - CHECKPOINT_RESTORE
               drop:
                 - ALL
           readinessProbe:
@@ -480,7 +479,6 @@ spec:
                 - SYS_ADMIN
                 - SYS_PTRACE
                 - SYS_RESOURCE
-                - CHECKPOINT_RESTORE
                 - IPC_LOCK
               drop:
                 - ALL