rootless: disable unsupported security stuff #1834
Conversation
Signed-off-by: Akihiro Suda <[email protected]>
|
I am not a maintainer, but LGTM |
| // Disable unsupported security stuff | ||
| spec.Process.User.AdditionalGids = nil | ||
| spec.Process.ApparmorProfile = "" | ||
| spec.Process.SelinuxLabel = "" |
There was a problem hiding this comment.
We can't just disable this stuff like that -- if a user has specified them in the configuration then we have to either fail or try to do what they've asked. If we just ignore it (which is what this change does) then we could lead users into thinking their container has security properties it doesn't.
Also spec.Process.User.AdditionalGids = nil will break containers that are using newgidmap to allow for setgroups and the mapping of multiple users (unless I'm mistaken). The same with CgroupsPath -- if a privileged process has set up cgroups for us then we can use them.
There was a problem hiding this comment.
I'm closing but AdditionalGids is not supported either way at the moment even when newgidmap is used
There was a problem hiding this comment.
I think we forgot to fix / remove that check when we added newgidmap support -- in principle it should work now that you can have setgroups=allow in a rootless container.
|
NACK. I'm pretty sure this'll break configurations that we shouldn't be breaking -- I'm a little confused that the tests are passing when this change breaks |
|
SELinux labeling is supported for non privilged users. SELinux does not care about whether you are UID=0 or any other UID. |
Signed-off-by: Akihiro Suda [email protected]