intel / intel/intel-technology-enabling-for-openshift
Remove RunAsAny (root) for qatlib container
- Dominant language
- Python
- Stars
- 22
- Forks
- 13
- PR merge metrics
- No merged PRs in 30d
Description
### Summary
Currently qatlib workload runs with [custom SCC](https://github.com/intel/intel-technology-enabling-for-openshift/blob/main/security/qatlib_scc.yaml) using IPC_LOCK and root permissions
### Detail
qatlib workload needs IPC_LOCK permission, added via custom SCC based on restricted-v2 default SCC. The container also needs to run as root according to [qatlib doc](https://github.com/intel/qatlib/blob/7429ee2b7c837137ed11959a3c2cc3729dc15739/INSTALL#L274). This is added with [RunAsAny permission ](https://github.com/intel/intel-technology-enabling-for-openshift/blob/85da1299d3877fd19d63713e7310f34d07db1735/security/qatlib_scc.yaml#L27)in custom SCC. This also enables container to access devices as root
### Possible solutions
1. To avoid access to host devices as root, follow https://github.com/intel/intel-technology-enabling-for-openshift/issues/35. Figure how to enable CRIO flag for every host. Possibly via privileged container daemonset.
2. Possibility to run qatlib container as non-root or a specific user?
Contributor guide
Assessment
This issue has not been assessed yet.