PWX-32294 : Reconfigure SCC templates (#1132)

* PWX-32294 : Reconfigure SCC templates * set AllowPrivilegeEscalation to false for portworx-restricted scc
libopenstorage · Jul 13, 2023 · faecc3e · faecc3e
1 parent 594afb4
commit faecc3e
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 9 deletions.
diff --git a/drivers/storage/portworx/component/securitycontextconstraints.go b/drivers/storage/portworx/component/securitycontextconstraints.go
@@ -191,11 +191,11 @@ func (s *scc) getSCCs(cluster *opcorev1.StorageCluster) []ocp_secv1.SecurityCont
 				Name: PxSCCName,
 			},
 			AllowHostDirVolumePlugin: true,
-			AllowHostIPC:             true,
+			AllowHostIPC:             false,
 			AllowHostNetwork:         true,
-			AllowHostPID:             true,
-			AllowHostPorts:           true,
-			AllowPrivilegeEscalation: boolPtr(true),
+			AllowHostPID:             false,
+			AllowHostPorts:           false,
+			AllowPrivilegeEscalation: boolPtr(false),
 			AllowPrivilegedContainer: true,
 			AllowedUnsafeSysctls:     []string{"*"},
 			AllowedCapabilities: []corev1.Capability{
@@ -236,7 +236,7 @@ func (s *scc) getSCCs(cluster *opcorev1.StorageCluster) []ocp_secv1.SecurityCont
 			AllowHostNetwork:         true,
 			AllowHostPID:             false,
 			AllowHostPorts:           false,
-			AllowPrivilegeEscalation: boolPtr(true),
+			AllowPrivilegeEscalation: boolPtr(false),
 			AllowPrivilegedContainer: false,
 			FSGroup: ocp_secv1.FSGroupStrategyOptions{
 				Type: ocp_secv1.FSGroupStrategyMustRunAs,

diff --git a/drivers/storage/portworx/testspec/portworxSCC.yaml b/drivers/storage/portworx/testspec/portworxSCC.yaml
@@ -1,9 +1,9 @@
 allowHostDirVolumePlugin: true
-allowHostIPC: true
+allowHostIPC: false
 allowHostNetwork: true
-allowHostPID: true
-allowHostPorts: true
-allowPrivilegeEscalation: true
+allowHostPID: false
+allowHostPorts: false
+allowPrivilegeEscalation: false
 allowPrivilegedContainer: true
 allowedCapabilities:
 - '*'