whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs/concepts/policy/pod-security-policy.md: improve AllowPrivilegeEscalation description. (#8000)

Browse Source
This commit is contained in:
Vyacheslav Semushin
2018-04-06 21:15:08 +02:00
committed by k8s-ci-robot
parent 8dff71a36b
commit 5b29154c0e
1 changed files with 2 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/concepts/policy/pod-security-policy.md
+2 -6
View File
@@ -480,14 +480,10 @@ from changing the effective user ID, and prevent files from enabling extra
capabilities (e.g. it will prevent the use of the `ping` tool). This behavior is capabilities (e.g. it will prevent the use of the `ping` tool). This behavior is
required to effectively enforce `MustRunAsNonRoot`. required to effectively enforce `MustRunAsNonRoot`.
It defaults to `nil`. The default behavior of `nil` allows privilege escalation
so as to not break setuid binaries. Setting it to `false` ensures that no child
process of a container can gain more privileges than its parent.
**AllowPrivilegeEscalation** - Gates whether or not a user is allowed to set the **AllowPrivilegeEscalation** - Gates whether or not a user is allowed to set the
security context of a container to `allowPrivilegeEscalation=true`. This security context of a container to `allowPrivilegeEscalation=true`. This
defaults to allowed. When set to false, the container's defaults to allowed so as to not break setuid binaries. Setting it to `false`
`allowPrivilegeEscalation` is defaulted to false. ensures that no child process of a container can gain more privileges than its parent.
**DefaultAllowPrivilegeEscalation** - Sets the default for the **DefaultAllowPrivilegeEscalation** - Sets the default for the
`allowPrivilegeEscalation` option. The default behavior without this is to allow `allowPrivilegeEscalation` option. The default behavior without this is to allow