From 5b29154c0ee10a187b4a9563ea7a03e512f30fec Mon Sep 17 00:00:00 2001 From: Vyacheslav Semushin Date: Fri, 6 Apr 2018 21:15:08 +0200 Subject: [PATCH] docs/concepts/policy/pod-security-policy.md: improve AllowPrivilegeEscalation description. (#8000) --- docs/concepts/policy/pod-security-policy.md | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/docs/concepts/policy/pod-security-policy.md b/docs/concepts/policy/pod-security-policy.md index dd2a072eb1..5c80934751 100644 --- a/docs/concepts/policy/pod-security-policy.md +++ b/docs/concepts/policy/pod-security-policy.md @@ -480,14 +480,10 @@ from changing the effective user ID, and prevent files from enabling extra capabilities (e.g. it will prevent the use of the `ping` tool). This behavior is required to effectively enforce `MustRunAsNonRoot`. -It defaults to `nil`. The default behavior of `nil` allows privilege escalation -so as to not break setuid binaries. Setting it to `false` ensures that no child -process of a container can gain more privileges than its parent. - **AllowPrivilegeEscalation** - Gates whether or not a user is allowed to set the security context of a container to `allowPrivilegeEscalation=true`. This -defaults to allowed. When set to false, the container's -`allowPrivilegeEscalation` is defaulted to false. +defaults to allowed so as to not break setuid binaries. Setting it to `false` +ensures that no child process of a container can gain more privileges than its parent. **DefaultAllowPrivilegeEscalation** - Sets the default for the `allowPrivilegeEscalation` option. The default behavior without this is to allow