From a20b8a6669ff9d06fbaaef4def3089b67042cece Mon Sep 17 00:00:00 2001 From: Sean Walberg Date: Mon, 29 Jun 2020 08:52:20 -0400 Subject: [PATCH] Also check for `allowPrivilegeEscalation` The Ambassador container needs both the NET_BIND_SERVICE capability and also securityContext.allowPrivilegeEscalation to be enabled, so updating the init script to check for both. It checks to make sure it's not disabled (love these double negatives) so that if we're on a non docker runtime it won't get tripped up. --- python/entrypoint.sh | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/python/entrypoint.sh b/python/entrypoint.sh index 2ddfb4ea8c..54568fecb1 100644 --- a/python/entrypoint.sh +++ b/python/entrypoint.sh @@ -347,8 +347,10 @@ kick_ads() { if [ -z "${pids[envoy]}" ]; then # Envoy isn't running. Start it. # First check to see if this process has the capability to bind to a low port, if so it can run Envoy through a wrapper to grant the same - capsh --decode=$(awk '/CapInh/ { print $2}' /proc/$$/status) | grep -q cap_net_bind_service - if [ $? -eq 0 ]; then + # To bind to the low port it can't have privilege escalation revoked, and needs the NET_BIND_SERVICE capability + nonewprivs=$(awk '/NoNewPrivs/ { print $2 }' /proc/$$/status) + capsh --decode=$(awk '/CapInh/ { print $2 }' /proc/$$/status) | grep -q cap_net_bind_service + if [ $? -eq 0 -a "X$nonewprivs" != "X1" ]; then log "cap_net_bind_service is supported, launching Envoy through a wrapper" launch "envoy-wrapper" wrapper "${envoy_flags[@]}" else