* Description of problem (please be detailed as possible and provide log snippests): The security context for rook-ceph and rook-ceph-csi does not have RequiredDropCapabilities set. Steps to reproduce: # oc get scc # oc describe scc rook-ceph | grep " Required Drop Capabilities" Required Drop Capabilities: <none> # oc describe scc rook-ceph-csi | grep " Required Drop Capabilities" Required Drop Capabilities: <none> Following best practices by OpenShift, this should be defined so that it follows the principle of least privileges when granting permissions. Can this be reviewed as it has been highlighted as a security issue in CIS OpenShift Benchmark? * Version of all relevant components (if applicable): ODF 4.10 and above
@tnielsen we can have `requiredDropCapabilities: [all]` but we do need some capabilities, like `MKNOD`those we can add those in `allowedCapabilities:[]`?
Let's look at restricting this priv in 4.14. For 4.13 it is too much a risk to break at this point.
While waiting for the fix, can i check if NET_BIND_SERVICE can be added to Required Drop Capabilities? # oc describe scc rook-ceph | grep " Required Drop Capabilities" Required Drop Capabilities: <none> # oc describe scc rook-ceph-csi | grep " Required Drop Capabilities" Required Drop Capabilities: <none>