add docs for AllowPrivilegeEscalation (#5448)

Signed-off-by: Jess Frazelle <acidburn@microsoft.com>
2017-09-20 13:14:24 -05:00
parent c3947d5ba5
commit 2bd62e674b
4 changed files with 41 additions and 19 deletions
@@ -24,6 +24,8 @@ a Pod or Container. Security context settings include:

 * [Seccomp](https://en.wikipedia.org/wiki/Seccomp): Limit a process's access to open file descriptors.

+* AllowPrivilegeEscalation: Controls whether a process can gain more privileges than its parent process. This bool directly controls whether the [`no_new_privs`](https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt) flag gets set on the container process. AllowPrivilegeEscalation is true always when the container is: 1) run as Privileged OR 2) has `CAP_SYS_ADMIN`.
+
 For more information about security mechanisms in Linux, see
 [Overview of Linux Kernel Security Features](https://www.linux.com/learn/overview-linux-kernel-security-features)

@@ -345,6 +347,8 @@ label given to all Containers in the Pod as well as the Volumes.
 * [Security Contexts design document](https://git.k8s.io/community/contributors/design-proposals/security_context.md)
 * [Ownership Management design document](https://git.k8s.io/community/contributors/design-proposals/volume-ownership-management.md)
 * [Pod Security Policies](/docs/concepts/policy/pod-security-policy/)
+* [AllowPrivilegeEscalation design
+  document](https://git.k8s.io/community/contributors/design-proposals/auth/no-new-privs.md)


 {% endcapture %}