Bootstrap the "privileged" SCC with all sysctls allowed

openshift · Jul 20, 2018 · 1a60d00 · 1a60d00
1 parent e9b4ddc
commit 1a60d00
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/pkg/cmd/server/bootstrappolicy/securitycontextconstraints.go b/pkg/cmd/server/bootstrappolicy/securitycontextconstraints.go
@@ -94,7 +94,8 @@ func GetBootstrapSecurityContextConstraints(sccNameToAdditionalGroups map[string
 			SupplementalGroups: securityapi.SupplementalGroupsStrategyOptions{
 				Type: securityapi.SupplementalGroupsStrategyRunAsAny,
 			},
-			SeccompProfiles: []string{"*"},
+			SeccompProfiles:      []string{"*"},
+			AllowedUnsafeSysctls: []string{"*"},
 		},
 		// SecurityContextConstraintNonRoot does not allow host access, allocates SELinux labels
 		// and allows the user to request a specific UID or provide the default in the dockerfile.