Description of problem: When use has restricted scc rule, it still can create privileged init container. Version-Release number of selected component (if applicable): openshift v3.3.0.9 kubernetes v1.3.0+57fb9ac etcd 2.3.0+git How reproducible: Always Steps to Reproduce: 1.Create a pod with privileged init container $ oc create -f https://raw.githubusercontent.com/mdshuai/testfile-openshift/master/initContainer/init-containers-privilege.yaml 2.Check the pod scc rule and status [root@dhcp-128-7 Desktop]# oc get pod hello-pod -o json | grep openshift.io/scc "openshift.io/scc": "restricted", [root@dhcp-128-7 Desktop]# oc get pod NAME READY STATUS RESTARTS AGE hello-pod 1/1 Running 0 14m Actual results: 2. The pod is running. Expected results: 1. Should restrict to create privileged init container when user has no permission Additional info: restricted user can also exec to the privileged container.
Fixed in https://github.com/openshift/origin/pull/9973
Fixed. openshift v3.3.0.11 kubernetes v1.3.0+57fb9ac etcd 2.3.0+git # oc create -f https://raw.githubusercontent.com/mdshuai/testfile-openshift/master/initContainer/init-containers-privilege.yaml Error from server: error when creating "https://raw.githubusercontent.com/mdshuai/testfile-openshift/master/initContainer/init-containers-privilege.yaml": pods "hello-pod" is forbidden: unable to validate against any security context constraint: [spec.initContainers[0].securityContext.privileged: Invalid value: true: Privileged containers are not allowed]