Skip to content

Commit f454894

Browse files
authored
Allow tcpdump sys_admin cap (#69969)
In the continuing quest to capture packets during network disruption, tcpdump is being used. In order for tcpdump to run, even as root, it switches users (even when -Z root) and OCP detects this as a privilege increase and prohibits it. Allow SETUID/SETGID, allowing this "change".
1 parent 70a1c72 commit f454894

File tree

1 file changed

+2
-0
lines changed

1 file changed

+2
-0
lines changed

clusters/build-clusters/common_except_app.ci/restricted-v2-plus-netadmin.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,8 @@ allowedCapabilities:
1010
- NET_BIND_SERVICE
1111
- NET_RAW
1212
- NET_ADMIN
13+
- SETUID
14+
- SETGID
1315
apiVersion: security.openshift.io/v1
1416
fsGroup:
1517
type: MustRunAs

0 commit comments

Comments
 (0)