Description of problem: If there exists a workload or runtime class that has the "io.kubernetes.cri-o.Devices" option enabled as an allowed_annotation, then CRI-O will mount any device into any container that requests that workload/runtime class and specifies that annotation. There needs to be some filtering mechanism so users are restricted in which devices they're allowed to set. Version-Release number of selected component (if applicable): only 4.10 is affected, and it has not been released yet. This bug will be made a blocker to prevent 4.10.0 going out the door with this issue. How reproducible: 100% Steps to Reproduce: 1. Add these two annotations to any pod: io.openshift.builder: "" io.kubernetes.cri-o.Devices: "/dev/random" # this can be any device Actual results: containers in the pod are allowed to access the device Expected results: the pod is denied access Additional info:
fixed in attached PR
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: OpenShift Container Platform 4.10.3 security update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2022:0056