Add required permissions and capabilities for runc

pkg/selfcontain/defaults.go

@@ -29,6 +29,34 @@ var allowedDevices = []*devices.Device{
 			Allow:       true,
 		},
 	},
+	{
+		Path:     "/dev/zero",
+		FileMode: 0o666,
+		Uid:      0,
+		Gid:      0,
+		Rule: devices.Rule{
+			Type:        devices.CharDevice,
+			Major:       1,
+			Minor:       5,
+			Permissions: "rwm",
+			Allow:       true,
+		},
+	},
+	{
+		Path:     "/dev/urandom",
+		FileMode: 0o666,
+		Uid:      0,
+		Gid:      0,
+		Rule: devices.Rule{
+			Type:        devices.CharDevice,
+			Major:       1,
+			Minor:       9,
+			Permissions: "rwm",
+			Allow:       true,
+		},
+	},
+	// Required by kubelet and other kubernetes related downstream
+	// processes
 	{
 		Path:     "/dev/kmsg",
 		FileMode: 0o666,
@@ -42,6 +70,8 @@ var allowedDevices = []*devices.Device{
 			Allow:       true,
 		},
 	},
+	// Required by many downstream processes, including anything
+	// like an http client which does tls
 	{
 		Path:     "/dev/random",
 		FileMode: 0o666,
@@ -55,6 +85,34 @@ var allowedDevices = []*devices.Device{
 			Allow:       true,
 		},
 	},
+	// Required by downstream runc for mounting
+	{
+		Path:     "/dev/full",
+		FileMode: 0o666,
+		Uid:      0,
+		Gid:      0,
+		Rule: devices.Rule{
+			Type:        devices.CharDevice,
+			Major:       1,
+			Minor:       7,
+			Permissions: "rw",
+			Allow:       true,
+		},
+	},
+	// Required by downstream containers for mounting a tty
+	{
+		Path:     "/dev/tty",
+		FileMode: 0o666,
+		Uid:      0,
+		Gid:      0,
+		Rule: devices.Rule{
+			Type:        devices.CharDevice,
+			Major:       5,
+			Minor:       0,
+			Permissions: "rw",
+			Allow:       true,
+		},
+	},
 }
 
 // These path will be mounted as a default base inside the container
@@ -114,9 +172,26 @@ var capabilities = []string{
 	"CAP_NET_ADMIN",
 	// Required for raw sockets, including ICMP
 	"CAP_NET_RAW",
-  // Required for unpacking archives and images
-  "CAP_CHOWN",
-  "CAP_DAC_OVERRIDE",
+	// Required for unpacking archives and images
+	"CAP_CHOWN",
+	"CAP_DAC_OVERRIDE",
+	// Required for adjusting oom score by runc
+	"CAP_SYS_RESOURCE",
+	// Required for setting uid and gid by runc
+	"CAP_SETUID",
+	"CAP_SETGID",
+	// Added temporarily to accomodate runc capabilities
+	"CAP_FOWNER",
+	"CAP_FSETID",
+	"CAP_KILL",
+	"CAP_SETPCAP",
+	"CAP_NET_BIND_SERVICE",
+	"CAP_NET_RAW",
+	"CAP_SYS_CHROOT",
+	"CAP_MKNOD",
+	"CAP_AUDIT_WRITE",
+	"CAP_SETFCAP",
+	"CAP_FSETID",
 }
 
 // These networks will be setup as a default base inside the container