Merge pull request kubernetes#85463 from AkihiroSuda/allow-net-ipv4-ping_group_range

k8s-ci-robot · web-flow · commit 4000732bec17 · 2019-12-10T16:05:06.000-08:00
SafeSysctlWhitelist: add net.ipv4.ping_group_range (allow ping without CAP_NET_RAW)
diff --git a/pkg/security/podsecuritypolicy/sysctl/mustmatchpatterns.go b/pkg/security/podsecuritypolicy/sysctl/mustmatchpatterns.go
@@ -34,6 +34,7 @@ func SafeSysctlWhitelist() []string {
 		"kernel.shm_rmid_forced",
 		"net.ipv4.ip_local_port_range",
 		"net.ipv4.tcp_syncookies",
+		"net.ipv4.ping_group_range",
 	}
 }
 

Original file line number	Diff line number	Diff line change
`@@ -34,6 +34,7 @@ func SafeSysctlWhitelist() []string {`
`34`	`34`	`"kernel.shm_rmid_forced",`
`35`	`35`	`"net.ipv4.ip_local_port_range",`
`36`	`36`	`"net.ipv4.tcp_syncookies",`
	`37`	`+ "net.ipv4.ping_group_range",`
`37`	`38`	`}`
`38`	`39`	`}`
`39`	`40`