Bug 1708202 - SCC admin policy sub-commands are broken
Summary: SCC admin policy sub-commands are broken
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: oc
Version: 4.1.0
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: ---
: 4.4.0
Assignee: Sally
QA Contact: zhou ying
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-05-09 11:12 UTC by Standa Laznicka
Modified: 2023-09-14 05:28 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2020-05-04 11:12:48 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2020:0581 0 None None None 2020-05-04 11:13:13 UTC

Description Standa Laznicka 2019-05-09 11:12:02 UTC
Description of problem:
In 4.1, the commands `oc adm policy add/remove-scc-*` are broken if applied on an SCC from the default SCC set - they have a very short-lived effect since the platform-provided SCCs are handled by the cluster version operator (CVO).

The aforementioned commands work by changing the Users/Groups fields of a specific SCC. If the SCC is one of the platform-provided, CVO will eventually stomp on the change and will revert it to platform-default

Version-Release number of selected component (if applicable):
4.1

How reproducible:
100%

Steps to Reproduce:
1. oc adm policy add-scc-to-user privileged milan
2. wait a bit

Actual results:
User "milan" won't eventually be able to set up pods that would require the "privileged" SCC .

Expected results:
User "milan" can create privileged pods unless removed from the "privileged" SCC by some other user.

Additional info:

WORKAROUND:
===========
It is possible to create a cluster role that would allow the user "use" the "privileged" SCC. The process of creating the cluster role and role bindings to it is described in the official documentation: https://docs.openshift.com/container-platform/4.1/authentication/managing-security-context-constraints.html#role-based-access-to-ssc-configuring-internal-oauth

Comment 1 Standa Laznicka 2019-05-30 15:32:24 UTC
https://github.com/openshift/origin/pull/22781

Comment 4 Maciej Szulik 2020-02-03 13:30:47 UTC
Sally, sync with Standa what needs to be done and let this ship in 4.4.

Comment 5 Sally 2020-02-27 19:00:56 UTC
I've confirmed with latest version `Cluster version is 4.5.0-0.ci-2020-02-27-004716` that this is no longer an issue.  I am able to:
$ oc adm policy add-scc-to-user privileged testuser, then create a privileged pod.  

Also, I confirmed I can:
$ oc adm policy remove-scc-from-user privileged testuser, then am no longer able to create the privileged pod.

Comment 8 zhou ying 2020-03-02 06:55:25 UTC
Confirmed with latest oc client, the issue has fixed:
[root@dhcp-140-138 v3-testfiles]# oc version -o yaml 
clientVersion:
  buildDate: "2020-02-28T23:32:38Z"
  compiler: gc
  gitCommit: bc08a48555986f64165555efd2705eff7ef2de81
  gitTreeState: clean
  gitVersion: 4.4.0-202002282323-bc08a48
  goVersion: go1.13.4
  major: ""
  minor: ""
  platform: linux/amd64


[root@dhcp-140-138 home]# oc adm policy add-scc-to-user privileged  testuser-2
securitycontextconstraints.security.openshift.io/privileged added to: ["testuser-2"]

[yinzhou@localhost roottest]$  oc whoami 
testuser-2
[yinzhou@localhost roottest]$ oc get po  -o yaml |grep privi
      openshift.io/scc: privileged
        privileged: true

Comment 10 errata-xmlrpc 2020-05-04 11:12:48 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:0581

Comment 11 Red Hat Bugzilla 2023-09-14 05:28:20 UTC
The needinfo request[s] on this closed bug have been removed as they have been unresolved for 1000 days


Note You need to log in before you can comment on or make changes to this bug.