container: Do not restrict path access for privileged containers
Privileged containers should see and reach all host paths.
@@ -466,6 +466,8 @@ func (s *Server) createSandboxContainer(ctx context.Context, containerID string,
specgen.SetProcessSelinuxLabel(sb.processLabel)
specgen.SetLinuxMountLabel(sb.mountLabel)
+ if containerConfig.GetLinux().GetSecurityContext() != nil &&
+ containerConfig.GetLinux().GetSecurityContext().Privileged == false {
for _, mp := range []string{
"/proc/kcore",
"/proc/latency_stats",
@@ -488,6 +490,7 @@ func (s *Server) createSandboxContainer(ctx context.Context, containerID string,
specgen.AddLinuxReadonlyPaths(rp)
}
}
+ }
// Join the namespace paths for the pod sandbox container.
podInfraState := s.runtime.ContainerStatus(sb.infraContainer)
