Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1440812

Summary: Capabilities specified in SCC not working
Product: OpenShift Container Platform Reporter: Joel Rosental R. <jrosenta>
Component: RFEAssignee: Paul Weil <pweil>
Status: CLOSED NEXTRELEASE QA Contact: Xiaoli Tian <xtian>
Severity: high Docs Contact:
Priority: high    
Version: 3.4.0CC: aos-bugs, decarr, erich, glamb, jokerman, jrosenta, mmccomas, sjenning, wmeng
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-04-12 16:27:37 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Joel Rosental R. 2017-04-10 14:10:51 UTC
Description of problem:
When trying to add capabilities to a container inside a pod after configuring the pod to run with privileged scc and specifying a service account to it that has been previously added to the privileged scc, I get the following error while trying to deploy the pod:

18s        3m          8         ruby-ex-2          ReplicationController                                 Warning   FailedCreate        {replication-controller }                     Error creating: pods "ruby-ex-2-" is forbidden: unable to validate against any security context constraint: [spec.containers[0].securityContext.privileged: Invalid value: true: Privileged containers are not allowed capabilities.add: Invalid value: "IPC_LOCK": capability may not be added capabilities.add: Invalid value: "SYS_RESOURCE": capability may not be added]

privileged SCC has been previously modified to allow "any" capability:

allowedCapabilities:
- '*'


Version-Release number of selected component (if applicable):

tested on 3.3 and 3.4 with same result


How reproducible:
always

Steps to Reproduce:
1. create a custom service account, e.g: `oc create serviceaccount root`

2. oc adm policy add-scc-to-user privileged system:serviceaccount:<yourproject>:root

3. Add the following snippet to the DeploymentConfig:
inside container definition:

securityContext:
  capabilities:
    add:
    - IPC_LOCK
    - SYS_RESOURCE
  privileged: true

outside container definition but still in pod definition:
serviceAccount: root
serviceAccountName: root

4.- Edit scc "privileged" setting the "allowedCapabilities" parameter to "*" (did this just to test).

4.- deploy the pod

Actual results:
Pod not created. Error creating: pods "ruby-ex-2-" is forbidden: unable to validate against any security context constraint: [spec.containers[0].securityContext.privileged: Invalid value: true: Privileged containers are not allowed capabilities.add: Invalid value: "IPC_LOCK": capability may not be added capabilities.add: Invalid value: "SYS_RESOURCE": capability may not be added]

Expected results:
Pod created with capabilities specified in the DeploymentConfig

Additional info:

Comment 2 Joel Rosental R. 2017-04-12 15:32:30 UTC
Seems to be related with:

 https://github.com/openshift/origin/pull/12875

Comment 3 Paul Weil 2017-04-12 16:27:37 UTC
Discussed in IRC.  Summary:

1. * is supported in 1.6+ by the PR listed above
2. Currently the customer must enumerate the capabilities in the SCC under the allowed capabilities
3. It also appears that they have not granted access to the privileged SCC correctly since there still is an error on the privileged field.  So that should be double checked.

Invalid value: true: Privileged containers are not allowed