[installer] manually set allowPrivilegeEscalation to false
#14918
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
started the job as gitpod-build-tar-disallow-escalation-explicitely.2 because the annotations in the pull request description changed |
github-actions
bot
added
team: SID
team: IDE
team: webapp
ArthurSens
approved these changes
Nov 24, 2022
jenting
approved these changes
Nov 24, 2022
easyCZ
approved these changes
Nov 25, 2022
|
/hold just for some more tests 👀 |
|
@Pothulapati While I agree that this in theory should not affect anything we should definitely test thoroughly. 💯 |
Pothulapati
force-pushed
the
tar/disallow-escalation-explicitely
branch
from
7d055c9 to
e932bd4
Compare
|
Update: Manual tests are all good i.e workspaces, prebuilds, etc. Waiting on |
Pothulapati
force-pushed
the
tar/disallow-escalation-explicitely
branch
2 times, most recently
from
cb4cb2d to
c84c9b3
Compare
This PR manually sets the `allowPrivilegeEscalation` container config to false where we don't need extra capabilities. This is needed as not setting this explicitely could mean that it could still be `true` based on other settings. This also helps us future proof on any behaviour changes around this. Signed-off-by: Tarun Pothulapati <tarun@gitpod.io>
Pothulapati
force-pushed
the
tar/disallow-escalation-explicitely
branch
from
c84c9b3 to
fc7b871
Compare
felladrin
approved these changes
Dec 5, 2022
roboquat
added
deployed: IDE
roboquat
added
the
deployed: workspace
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This PR manually sets the
allowPrivilegeEscalationcontainer config to false wherewe don't need extra capabilities. Though this does not effect anything yet,
This is needed as not setting this explicitely could mean that it could still be
truebased on some other settings.
This also helps us future proof on any behaviour changes around this.
This skips the following components as they need privilege access:
agent-smithcomponent containerws-daemonComponent containershiftfscontainerSigned-off-by: Tarun Pothulapati tarun@gitpod.io
Related Issue(s)
Part of https://github.com/gitpod-io/security/issues/70
How to test
Tested that workspaces start correctly through a preview environment
Release Notes
Documentation
Werft options:
If enabled this will build
install/previewValid options are
all,workspace,webapp,ide,jetbrains,vscode,ssh