Managing Security Context Constraints

Listing Security Context Constraints

To get a current list of SCCs:

You can view information about a particular SCC, including which users, service accounts, and groups the SCC is applied to.

For example, to examine the restricted SCC:

Name:                    restricted
Priority:                <none>
Access:
  Users:                <none> (1)
  Groups:                system:authenticated (2)
Settings:
  Allow Privileged:            false
  Default Add Capabilities:        <none>
  Required Drop Capabilities:        KILL,MKNOD,SYS_CHROOT,SETUID,SETGID
  Allowed Capabilities:            <none>
  Allowed Seccomp Profiles:        <none>
  Allowed Volume Types:            configMap,downwardAPI,emptyDir,persistentVolumeClaim,projected,secret
  Allow Host Network:            false
  Allow Host Ports:            false
  Allow Host PID:            false
  Allow Host IPC:            false
  Read Only Root Filesystem:        false
  Run As User Strategy: MustRunAsRange
    UID:                <none>
    UID Range Min:            <none>
  SELinux Context Strategy: MustRunAs
    User:                <none>
    Role:                <none>
    Type:                <none>
    Level:                <none>
  FSGroup Strategy: MustRunAs
    Ranges:                <none>
  Supplemental Groups Strategy: RunAsAny
    Ranges:                <none>

Creating New Security Context Constraints

To create a new SCC:

1. Define the SCC in a JSON or YAML file:

   Security Context Constraint Object Definition

   kind: SecurityContextConstraints
   apiVersion: v1
   metadata:
     name: scc-admin
   allowPrivilegedContainer: true
   runAsUser:
     type: RunAsAny
   seLinuxContext:
     type: RunAsAny
   fsGroup:
     type: RunAsAny
   supplementalGroups:
     type: RunAsAny
   - my-admin-user
   groups:
   - my-admin-group

   Optionally, you can add drop capabilities to an SCC by setting the **requiredDropCapabilities** field with the desired values. Any specified capabilities will be dropped from the container. For example, to create an SCC with the **KILL**, **MKNOD**, and **SYS_CHROOT** required drop capabilities, add the following to the SCC object:

   requiredDropCapabilities:
   - KILL
   - MKNOD
   - SYS_CHROOT

   You can see the list of possible values in the .

   Because capabilities are passed to the Docker, you can use a special ALL value to drop all possible capabilities.

2. Then, run oc create passing the file to create it:

   $ oc create -f scc_admin.yaml
   securitycontextconstraints "scc-admin" created

3. Verify that the SCC was created:

   $ oc get scc scc-admin
   NAME        PRIV      CAPS      SELINUX    RUNASUSER   FSGROUP    SUPGROUP   PRIORITY   READONLYROOTFS   VOLUMES
   scc-admin   true      []        RunAsAny   RunAsAny    RunAsAny   RunAsAny   <none>     false            [awsElasticBlockStore azureDisk azureFile cephFS cinder configMap downwardAPI emptyDir fc flexVolume flocker gcePersistentDisk glusterfs iscsi nfs persistentVolumeClaim photonPersistentDisk quobyte rbd secret vsphere]

To delete an SCC:

$ oc delete scc <scc_name>

Updating Security Context Constraints

To update an existing SCC:

$ oc edit scc <scc_name>

Without Explicit runAsUser Setting

With Explicit runAsUser Setting

kind: Pod
metadata:
  name: security-context-demo
spec:
  securityContext:
    runAsUser: 1000 (1)
  containers:
    - name: sec-ctx-demo
      image: gcr.io/google-samples/node-hello:1.0

This works with SELinux, fsGroup, and Supplemental Groups. See Volume Security for more information.

Default SCCs will be created when the master is started if they are missing. To reset SCCs to defaults, or update existing SCCs to new default definitions after an upgrade you may:

1. Delete any SCC you would like to be reset and let it be recreated by restarting the master

The oc adm policy reconcile-sccs command will set all SCC policies to the default values but retain any additional users, groups, labels, and annotations as well as priorities you may have already set. To view which SCCs will be changed you may run the command with no options or by specifying your preferred output with the -o <format> option.

After reviewing it is recommended that you back up your existing SCCs and then use the --confirm option to persist the data.

How Do I?

The following describe common scenarios and procedures using SCCs.

Grant Access to the Privileged SCC

In some cases, an administrator might want to allow users or groups outside the administrator group access to create more privileged pods. To do so, you can:

1. Determine the user or group you would like to have access to the SCC.

   Granting access to a user only works when the user directly creates a pod. For pods created on behalf of a user, in most cases by the system itself, access should be given to a service account under which related controller is operated upon. Examples of resources that create pods on behalf of a user are Deployments, StatefulSets, DaemonSets, etc.

2. Run:

   $ oc adm policy add-scc-to-user <scc_name> <user_name>
   $ oc adm policy add-scc-to-group <scc_name> <group_name>

   For example, to allow the e2e-user access to the privileged SCC, run:

   $ oc adm policy add-scc-to-user privileged e2e-user

3. Modify SecurityContext of a container to request a privileged mode.

Grant a Service Account Access to the Privileged SCC

First, create a service account. For example, to create service account in project myproject:

$ oc create serviceaccount mysvcacct -n myproject

Then, add the service account to the privileged SCC.

$ oc adm policy add-scc-to-user privileged system:serviceaccount:myproject:mysvcacct

Then, ensure that the resource is being created on behalf of the service account. To do so, set the spec.serviceAccountName field to a service account name. Leaving the service account name blank will result in the default service account being used.

Then, ensure that at least one of the pod’s containers is requesting a privileged mode in the security context.

To relax the security in your cluster so that images are not forced to run as a pre-allocated UID, without granting everyone access to the privileged SCC:

1. Grant all authenticated users access to the anyuid SCC:

   $ oc adm policy add-scc-to-group anyuid system:authenticated

Enable Container Images that Require Root

Some container images (examples: postgres and redis) require root access and have certain expectations about how volumes are owned. For these images, add the service account to the anyuid SCC.

$ oc adm policy add-scc-to-user anyuid system:serviceaccount:myproject:mysvcacct

Use —mount-host on the Registry

It is recommended that using **PersistentVolume** and **PersistentVolumeClaim** objects be used for registry deployments. If you are testing and would like to instead use the oc adm registry command with the --mount-host option, you must first create a new for the registry and add it to the privileged SCC. See the Administrator Guide for full instructions.

In some cases, an image may require capabilities that Docker does not provide out of the box. You can provide the ability to request additional capabilities in the pod specification which will be validated against an SCC.

When used in conjunction with a non-root user, you must also ensure that the file that requires the additional capability is granted the capabilities using the setcap command. For example, in the Dockerfile of the image:

To provide additional capabilities:

1. Create a new SCC

2. Add the allowed capability using the **allowedCapabilities** field.

3. When creating the pod, request the capability in the **securityContext.capabilities.add** field.

Modify Cluster Default Behavior

When you grant access to the anyuid SCC for everyone, your cluster:

• Does not pre-allocate UIDs

• Allows containers to run as any user

• Prevents privileged containers

 $ oc adm policy add-scc-to-group anyuid system:authenticated

To modify your cluster so that it does not pre-allocate UIDs and does not allow containers to run as root, grant access to the nonroot SCC for everyone:

 $ oc adm policy add-scc-to-group nonroot system:authenticated

Use the hostPath Volume Plug-in

To relax the security in your cluster so that pods are allowed to use the hostPath volume plug-in without granting everyone access to more privileged SCCs such as privileged, hostaccess, or hostmount-anyuid, perform the following actions:

1. named hostpath

2. Set the **allowHostDirVolumePlugin** parameter to true for the new SCC:

   $ oc patch scc hostpath -p '{"allowHostDirVolumePlugin": true}'

3. Grant access to this SCC to all users:

   $ oc adm policy add-scc-to-group hostpath system:authenticated

Now, all the pods that request hostPath volumes are admitted by the hostpath SCC.

You may control the sort ordering of SCCs in admission by setting the Priority field of the SCCs. See the SCC Prioritization section for more information on sorting.

Add an SCC to a User, Group, or Project

Before adding an SCC to a user or group, you can first use the scc-review option to check if the user or group can create a pod. See the Authorization topic for more information.

SCCs are not granted directly to a project. Instead, you add a service account to an SCC and either specify the service account name on your pod or, when unspecified, run as the default service account.

To add an SCC to a user:

$ oc adm policy add-scc-to-user <scc_name> <user_name>

To add an SCC to a service account:

$ oc adm policy add-scc-to-user <scc_name> \
    system:serviceaccount:<serviceaccount_namespace>:<serviceaccount_name>

If you are currently in the project to which the service account belongs, you can use the -z flag and just specify the <serviceaccount_name>.

$ oc adm policy add-scc-to-user <scc_name> -z <serviceaccount_name>

To add an SCC to all service accounts in a namespace:

$ oc adm policy add-scc-to-group <scc_name> \