Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Drop capabilities in s2i build container by default #7864

Merged
merged 2 commits into from Mar 9, 2016

Conversation

csrwng
Copy link
Contributor

@csrwng csrwng commented Mar 8, 2016

The container that is launched by s2i (outside of Kube control) currently allows an escalation of privilege via su or sudo. We can prevent this by dropping the same capabilities that are dropped for regular pods when running under the restricted SCC.

Fixes BZ 1315187

@csrwng
Copy link
Contributor Author

csrwng commented Mar 8, 2016

@bparees @mfojtik @liggitt

@csrwng
Copy link
Contributor Author

csrwng commented Mar 8, 2016

[testonlyextended][extended:core(builds)]

@openshift-bot
Copy link
Contributor

Evaluated for origin testonlyextended up to 26e798b

@openshift-bot
Copy link
Contributor

continuous-integration/openshift-jenkins/testonlyextended FAILURE (https://ci.openshift.redhat.com/jenkins/job/test_pr_origin/1930/) (Extended Tests: core(builds))

@bparees
Copy link
Contributor

bparees commented Mar 8, 2016

I think you can avoid the builder image build by just including the customized assemble script as ".s2i/bin" in the context dir you upload as the binary input, no?

@csrwng
Copy link
Contributor Author

csrwng commented Mar 9, 2016

I also set the root password in the builder image and install 'expect'

@bparees
Copy link
Contributor

bparees commented Mar 9, 2016

so you do. lgtm, pending resolution to the tests failing.

@csrwng
Copy link
Contributor Author

csrwng commented Mar 9, 2016

@bparees, I opened issues for the tests that failed:
#7904
#7906
#7910
#7911

none of those are related to this change.
[test]

@openshift-bot
Copy link
Contributor

Evaluated for origin test up to 26e798b

@bparees
Copy link
Contributor

bparees commented Mar 9, 2016

@csrwng thanks, lgtm.
[merge]

@openshift-bot
Copy link
Contributor

continuous-integration/openshift-jenkins/merge SUCCESS (https://ci.openshift.redhat.com/jenkins/job/merge_pull_requests_origin/5261/) (Image: devenv-rhel7_3668)

@openshift-bot
Copy link
Contributor

Evaluated for origin merge up to 26e798b

@openshift-bot
Copy link
Contributor

continuous-integration/openshift-jenkins/test FAILURE (https://ci.openshift.redhat.com/jenkins/job/test_pr_origin/1965/) (Extended Tests: core(builds))

openshift-bot pushed a commit that referenced this pull request Mar 9, 2016
@openshift-bot openshift-bot merged commit 2d0350c into openshift:master Mar 9, 2016
@csrwng csrwng deleted the s2i_dropcaps branch July 19, 2016 15:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants