From 3d358c9df35fd880ec75bb9b28c509d5b727c795 Mon Sep 17 00:00:00 2001 From: Michael Crosby Date: Wed, 2 Dec 2020 06:51:37 -0500 Subject: [PATCH] [cri] don't clear base security settings When a base runtime spec is being used, admins can configure defaults for the spec so that default ulimits or other security related settings get applied for all containers launched. Signed-off-by: Michael Crosby --- pkg/cri/server/container_create_linux.go | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/pkg/cri/server/container_create_linux.go b/pkg/cri/server/container_create_linux.go index 6c4eaeb0b..a551b2efb 100644 --- a/pkg/cri/server/container_create_linux.go +++ b/pkg/cri/server/container_create_linux.go @@ -114,13 +114,20 @@ func (c *criService) containerSpec(id string, sandboxID string, sandboxPid uint3 specOpts := []oci.SpecOpts{ customopts.WithoutRunMount, - customopts.WithoutDefaultSecuritySettings, + } + // only clear the default security settings if the runtime does not have a custom + // base runtime spec spec. Admins can use this functionality to define + // default ulimits, seccomp, or other default settings. + if ociRuntime.BaseRuntimeSpec == "" { + specOpts = append(specOpts, customopts.WithoutDefaultSecuritySettings) + } + specOpts = append(specOpts, customopts.WithRelativeRoot(relativeRootfsPath), customopts.WithProcessArgs(config, imageConfig), oci.WithDefaultPathEnv, // this will be set based on the security context below oci.WithNewPrivileges, - } + ) if config.GetWorkingDir() != "" { specOpts = append(specOpts, oci.WithProcessCwd(config.GetWorkingDir())) } else if imageConfig.WorkingDir != "" {