Support NoNewPrivileges

fixes #117 Signed-off-by: Yanqiang Miao <miao.yanqiang@zte.com.cn>
2017-08-23 09:45:44 +08:00
parent 810ffbb9b6
commit 1aec120d5f
3 changed files with 7 additions and 1 deletions
--- a/pkg/server/container_create.go
+++ b/pkg/server/container_create.go
@@ -214,6 +214,9 @@ func (c *criContainerdService) generateContainerSpec(id string, sandboxPid uint3
 		// TODO(random-liu): [P1] Set selinux options.

 		// TODO(random-liu): [P2] Add apparmor and seccomp.
+
+		// TODO: Figure out whether we should set no new privilege for sandbox container by default
+		g.SetProcessNoNewPrivileges(securityContext.GetNoNewPrivs())
 	}

 	g.SetRootReadonly(securityContext.GetReadonlyRootfs())