Merge pull request #155 from miaoyq/support-nonewprivileges

Support NoNewPrivileges
2017-08-23 20:58:38 -07:00
parent 60c7f5127e 1aec120d5f
commit 2faa665eb2
3 changed files with 7 additions and 1 deletions
--- a/pkg/server/container_create.go
+++ b/pkg/server/container_create.go
@@ -244,6 +244,9 @@ func (c *criContainerdService) generateContainerSpec(id string, sandboxPid uint3
 		// TODO(random-liu): [P1] Set selinux options.

 		// TODO(random-liu): [P2] Add apparmor and seccomp.
+
+		// TODO: Figure out whether we should set no new privilege for sandbox container by default
+		g.SetProcessNoNewPrivileges(securityContext.GetNoNewPrivs())
 	}

 	g.SetRootReadonly(securityContext.GetReadonlyRootfs())