Low privileged users able to use unconfined seccomp profile via restricted-v2 SCC
Issue
- While creating a pod/deployment with
seccompProfile: Unconfined, why the pod's security context is matched against therestricted-v2SCC given thatrestricted-v2prohibits unconfined seccomp profiles? - It's evident that the only
Seccompprofile allowed isruntime/default
$ oc describe scc restricted-v2 | grep Seccomp
Allowed Seccomp Profiles: runtime/default
Environment
- Red Hat OpenShift Container Platform
- 4.11,4.12
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.