Skip to content

Commit bda3e74

Browse files
bergerhofferbergerhoffer
committed
OCPBUGS-162: Updating restricted description and noting difference in upgrade vs install behavior
1 parent d212607 commit bda3e74

4 files changed

+54
-45
lines changed

‎modules/security-context-constraints-about.adoc

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -132,7 +132,7 @@ Setting `privileged: true` in the pod specification does not necessarily select
132132
endif::[]
133133

134134
|`restricted`
135-
|Denies access to all host features and requires pods to be run with a UID, and SELinux context that are allocated to the namespace. This is the most restrictive SCC provided by a new installation and will be used by default for authenticated users.
135+
|Denies access to all host features and requires pods to be run with a UID, and SELinux context that are allocated to the namespace.
136136

137137
The `restricted` SCC:
138138

@@ -143,10 +143,7 @@ The `restricted` SCC:
143143
* Allows pods to use any FSGroup
144144
* Allows pods to use any supplemental group
145145

146-
[NOTE]
147-
====
148-
The restricted SCC is the most restrictive of the SCCs that ship by default with the system. However, you can create a custom SCC that is even more restrictive. For example, you can create an SCC that restricts `readOnlyRootFS` to `true` and `allowPrivilegeEscalation` to `false`.
149-
====
146+
In clusters that were upgraded from {product-title} 4.10 or earlier, this SCC is available for use by any authenticated user. The `restricted` SCC is no longer available to users of new {product-title} 4.11 installations, unless the access is explicitly granted.
150147

151148
|`restricted-v2`
152149
| Like the `restricted` SCC, but with the following differences:
@@ -156,6 +153,13 @@ The restricted SCC is the most restrictive of the SCCs that ship by default with
156153
* `seccompProfile` is set to `runtime/default` by default.
157154
* `allowPrivilegeEscalation` must be unset or set to `false` in security contexts.
158155

156+
This is the most restrictive SCC provided by a new installation and will be used by default for authenticated users.
157+
158+
[NOTE]
159+
====
160+
The `restricted-v2` SCC is the most restrictive of the SCCs that is included by default with the system. However, you can create a custom SCC that is even more restrictive. For example, you can create an SCC that restricts `readOnlyRootFilesystem` to `true`.
161+
====
162+
159163
|===
160164

161165
[id="scc-settings_{context}"]
@@ -202,7 +206,7 @@ The containers use the capabilities from this default list, but pod manifest aut
202206

203207
[NOTE]
204208
====
205-
You can drop all capabilites from containers by setting the `requiredDropCapabilities` parameter to `ALL`.
209+
You can drop all capabilites from containers by setting the `requiredDropCapabilities` parameter to `ALL`. This is what the `restricted-v2` SCC does.
206210
====
207211

208212
[id="authorization-SCC-strategies_{context}"]

‎modules/security-context-constraints-command-reference.adoc

Lines changed: 40 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -28,15 +28,18 @@ $ oc get scc
2828
.Example output
2929
[source,terminal]
3030
----
31-
NAME PRIV CAPS SELINUX RUNASUSER FSGROUP SUPGROUP PRIORITY READONLYROOTFS VOLUMES
32-
anyuid false [] MustRunAs RunAsAny RunAsAny RunAsAny 10 false [configMap downwardAPI emptyDir persistentVolumeClaim projected secret]
33-
hostaccess false [] MustRunAs MustRunAsRange MustRunAs RunAsAny <none> false [configMap downwardAPI emptyDir hostPath persistentVolumeClaim projected secret]
34-
hostmount-anyuid false [] MustRunAs RunAsAny RunAsAny RunAsAny <none> false [configMap downwardAPI emptyDir hostPath nfs persistentVolumeClaim projected secret]
35-
hostnetwork false [] MustRunAs MustRunAsRange MustRunAs MustRunAs <none> false [configMap downwardAPI emptyDir persistentVolumeClaim projected secret]
36-
node-exporter false [] RunAsAny RunAsAny RunAsAny RunAsAny <none> false [*]
37-
nonroot false [] MustRunAs MustRunAsNonRoot RunAsAny RunAsAny <none> false [configMap downwardAPI emptyDir persistentVolumeClaim projected secret]
38-
privileged true [*] RunAsAny RunAsAny RunAsAny RunAsAny <none> false [*]
39-
restricted false [] MustRunAs MustRunAsRange MustRunAs RunAsAny <none> false [configMap downwardAPI emptyDir persistentVolumeClaim projected secret]
31+
NAME PRIV CAPS SELINUX RUNASUSER FSGROUP SUPGROUP PRIORITY READONLYROOTFS VOLUMES
32+
anyuid false <no value> MustRunAs RunAsAny RunAsAny RunAsAny 10 false ["configMap","downwardAPI","emptyDir","persistentVolumeClaim","projected","secret"]
33+
hostaccess false <no value> MustRunAs MustRunAsRange MustRunAs RunAsAny <no value> false ["configMap","downwardAPI","emptyDir","hostPath","persistentVolumeClaim","projected","secret"]
34+
hostmount-anyuid false <no value> MustRunAs RunAsAny RunAsAny RunAsAny <no value> false ["configMap","downwardAPI","emptyDir","hostPath","nfs","persistentVolumeClaim","projected","secret"]
35+
hostnetwork false <no value> MustRunAs MustRunAsRange MustRunAs MustRunAs <no value> false ["configMap","downwardAPI","emptyDir","persistentVolumeClaim","projected","secret"]
36+
hostnetwork-v2 false ["NET_BIND_SERVICE"] MustRunAs MustRunAsRange MustRunAs MustRunAs <no value> false ["configMap","downwardAPI","emptyDir","persistentVolumeClaim","projected","secret"]
37+
node-exporter true <no value> RunAsAny RunAsAny RunAsAny RunAsAny <no value> false ["*"]
38+
nonroot false <no value> MustRunAs MustRunAsNonRoot RunAsAny RunAsAny <no value> false ["configMap","downwardAPI","emptyDir","persistentVolumeClaim","projected","secret"]
39+
nonroot-v2 false ["NET_BIND_SERVICE"] MustRunAs MustRunAsNonRoot RunAsAny RunAsAny <no value> false ["configMap","downwardAPI","emptyDir","persistentVolumeClaim","projected","secret"]
40+
privileged true ["*"] RunAsAny RunAsAny RunAsAny RunAsAny <no value> false ["*"]
41+
restricted false <no value> MustRunAs MustRunAsRange MustRunAs RunAsAny <no value> false ["configMap","downwardAPI","emptyDir","persistentVolumeClaim","projected","secret"]
42+
restricted-v2 false ["NET_BIND_SERVICE"] MustRunAs MustRunAsRange MustRunAs RunAsAny <no value> false ["configMap","downwardAPI","emptyDir","persistentVolumeClaim","projected","secret"]
4043
----
4144

4245
[id="examining-a-security-context-constraints-object_{context}"]
@@ -54,36 +57,40 @@ $ oc describe scc restricted
5457
.Example output
5558
[source,terminal]
5659
----
57-
Name: restricted
58-
Priority: <none>
60+
Name: restricted
61+
Priority: <none>
5962
Access:
60-
Users: <none> <1>
61-
Groups: system:authenticated <2>
63+
Users: <none> <1>
64+
Groups: <none> <2>
6265
Settings:
63-
Allow Privileged: false
64-
Default Add Capabilities: <none>
65-
Required Drop Capabilities: KILL,MKNOD,SYS_CHROOT,SETUID,SETGID
66-
Allowed Capabilities: <none>
67-
Allowed Seccomp Profiles: <none>
68-
Allowed Volume Types: configMap,downwardAPI,emptyDir,persistentVolumeClaim,projected,secret
69-
Allow Host Network: false
70-
Allow Host Ports: false
71-
Allow Host PID: false
72-
Allow Host IPC: false
73-
Read Only Root Filesystem: false
66+
Allow Privileged: false
67+
Allow Privilege Escalation: true
68+
Default Add Capabilities: <none>
69+
Required Drop Capabilities: KILL,MKNOD,SETUID,SETGID
70+
Allowed Capabilities: <none>
71+
Allowed Seccomp Profiles: <none>
72+
Allowed Volume Types: configMap,downwardAPI,emptyDir,persistentVolumeClaim,projected,secret
73+
Allowed Flexvolumes: <all>
74+
Allowed Unsafe Sysctls: <none>
75+
Forbidden Sysctls: <none>
76+
Allow Host Network: false
77+
Allow Host Ports: false
78+
Allow Host PID: false
79+
Allow Host IPC: false
80+
Read Only Root Filesystem: false
7481
Run As User Strategy: MustRunAsRange
75-
UID: <none>
76-
UID Range Min: <none>
77-
UID Range Max: <none>
82+
UID: <none>
83+
UID Range Min: <none>
84+
UID Range Max: <none>
7885
SELinux Context Strategy: MustRunAs
79-
User: <none>
80-
Role: <none>
81-
Type: <none>
82-
Level: <none>
86+
User: <none>
87+
Role: <none>
88+
Type: <none>
89+
Level: <none>
8390
FSGroup Strategy: MustRunAs
84-
Ranges: <none>
91+
Ranges: <none>
8592
Supplemental Groups Strategy: RunAsAny
86-
Ranges: <none>
93+
Ranges: <none>
8794
----
8895
<1> Lists which users and service accounts the SCC is applied to.
8996
<2> Lists which groups the SCC is applied to.
@@ -112,7 +119,6 @@ If you delete a default SCC, it will regenerate when you restart the cluster.
112119
====
113120

114121
[id="updating-security-context-constraints_{context}"]
115-
116122
== Updating security context constraints
117123

118124
To update an existing SCC:

‎modules/security-context-constraints-example.adoc

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,7 @@ The `users` and `groups` fields on the SCC control which users can access the
8080
SCC.
8181
By default, cluster administrators, nodes, and the build controller are granted
8282
access to the privileged SCC. All authenticated users are granted access to the
83-
restricted SCC.
83+
`restricted-v2` SCC.
8484

8585
.Without explicit `runAsUser` setting
8686
[source,yaml]
@@ -96,17 +96,16 @@ spec:
9696
image: gcr.io/google-samples/node-hello:1.0
9797
----
9898
<1> When a container or pod does not request a user ID under which it should be run,
99-
the effective UID depends on the SCC that emits this pod. Because restricted SCC
99+
the effective UID depends on the SCC that emits this pod. Because the `restricted-v2` SCC
100100
is granted to all authenticated users by default, it will be available to all
101-
users and service accounts and used in most cases. The restricted SCC uses
101+
users and service accounts and used in most cases. The `restricted-v2` SCC uses
102102
`MustRunAsRange` strategy for constraining and defaulting the possible values of
103103
the `securityContext.runAsUser` field. The admission plug-in will look for the
104104
`openshift.io/sa.scc.uid-range` annotation on the current project to populate
105105
range fields, as it does not provide this range. In the end, a container will
106106
have `runAsUser` equal to the first value of the range that is
107107
hard to predict because every project has different ranges.
108108

109-
110109
.With explicit `runAsUser` setting
111110
[source,yaml]
112111
----

‎modules/security-context-constraints-rbac.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,5 +62,5 @@ user-defined SCC called `scc-name`.
6262
Because RBAC is designed to prevent escalation, even project administrators
6363
are unable to grant access to an SCC. By default, they are not
6464
allowed to use the verb `use` on SCC resources, including the
65-
`restricted` SCC.
65+
`restricted-v2` SCC.
6666
====

0 commit comments

Comments
 (0)