Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

limit privileged flag for mgmt-framework container #17217

Merged
merged 1 commit into from
Nov 28, 2023
Merged

limit privileged flag for mgmt-framework container #17217

merged 1 commit into from
Nov 28, 2023

Conversation

maipbui
Copy link
Contributor

@maipbui maipbui commented Nov 17, 2023

Why I did it

HLD implementation: Container Hardening (sonic-net/SONiC#1364)

Work item tracking
  • Microsoft ADO (number only): 14807420

How I did it

Reduce linux capabilities in privileged flag

How to verify it

Check container's settings: Privileged is false and container only has default Linux caps, does not have extended caps.

admin@vlab-01:~$ docker inspect mgmt-framework | grep Privi
            "Privileged": false,


admin@vlab-01:~$ docker exec -it mgmt-framework bash
root@vlab-01:/# capsh --print
Current: cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap=ep

Which release branch to backport (provide reason below if selected)

  • 201811
  • 201911
  • 202006
  • 202012
  • 202106
  • 202111
  • 202205
  • 202211
  • 202305

Tested branch (Please provide the tested image version)

Description for the changelog

Link to config_db schema for YANG module changes

A picture of a cute animal (not mandatory but encouraged)

@maipbui maipbui mentioned this pull request Nov 17, 2023
Merged
@maipbui
Copy link
Contributor Author

maipbui commented Nov 21, 2023

@anand-kumar-subramanian could you help review this PR or direct to appropriate reviewer?

xumia
xumia approved these changes Nov 28, 2023
View reviewed changes
Copy link
Collaborator

@xumia xumia left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@xumia xumia merged commit 80615f4 into sonic-net:master Nov 28, 2023
20 checks passed
@maipbui maipbui deleted the mgmtfrmwk_priv branch November 28, 2023 10:38
yxieca pushed a commit that referenced this pull request Dec 4, 2023
@maipbui @yxieca
[docker-sonic-mgmt-framework] limit privileged flag for mgmt-framewor…
a40daff 
…k container (#17217)

Why I did it
HLD implementation: Container Hardening (sonic-net/SONiC#1364)

Work item tracking
Microsoft ADO (number only): 14807420
How I did it
Reduce linux capabilities in privileged flag

How to verify it
Check container's settings: Privileged is false and container only has default Linux caps, does not have extended caps.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@xumia xumia xumia approved these changes

@sachinholla sachinholla sachinholla approved these changes

@qiluo-msft qiluo-msft Awaiting requested review from qiluo-msft qiluo-msft is a code owner

@lguohan lguohan Awaiting requested review from lguohan lguohan is a code owner

@anand-kumar-subramanian anand-kumar-subramanian Awaiting requested review from anand-kumar-subramanian

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@maipbui @sachinholla @xumia