intel / intel/intel-technology-enabling-for-openshift

Remove RunAsAny (root) for qatlib container

Open
#145 2 comments 0 reactions 0 assignees View on GitHub
qat
Dominant language
Python
Stars
22
Forks
13
PR merge metrics
No merged PRs in 30d

Description

### Summary
Currently qatlib workload runs with [custom SCC](https://github.com/intel/intel-technology-enabling-for-openshift/blob/main/security/qatlib_scc.yaml) using IPC_LOCK and root permissions

### Detail
qatlib workload needs IPC_LOCK permission, added via custom SCC based on restricted-v2 default SCC. The container also needs to run as root according to [qatlib doc](https://github.com/intel/qatlib/blob/7429ee2b7c837137ed11959a3c2cc3729dc15739/INSTALL#L274). This is added with [RunAsAny permission ](https://github.com/intel/intel-technology-enabling-for-openshift/blob/85da1299d3877fd19d63713e7310f34d07db1735/security/qatlib_scc.yaml#L27)in custom SCC. This also enables container to access devices as root
### Possible solutions
1. To avoid access to host devices as root, follow https://github.com/intel/intel-technology-enabling-for-openshift/issues/35. Figure how to enable CRIO flag for every host. Possibly via privileged container daemonset.
2. Possibility to run qatlib container as non-root or a specific user?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.