Add noexec nodev and nosuid to sandbox /etc/resolv.conf mount bind.

Signed-off-by: Vinayak Goyal <vinaygo@google.com>
2023-03-24 21:34:34 +00:00 · 2023-03-24 21:34:34 +00:00 · ae4dbb60d5
commit ae4dbb60d5
parent f7f2be7321
1 changed files with 1 additions and 1 deletions
--- a/pkg/cri/server/sandbox_run_linux.go
+++ b/pkg/cri/server/sandbox_run_linux.go
@ -133,7 +133,7 @@ func (c *criService) sandboxContainerSpec(id string, config *runtime.PodSandboxC
 			Source:      c.getResolvPath(id),
 			Destination: resolvConfPath,
 			Type:        "bind",
-			Options:     []string{"rbind", "ro"},
+			Options:     []string{"rbind", "ro", "nosuid", "nodev", "noexec"},
 		},
 	}))