12.4. Creating security context constraints

Procedure

1. Define the SCC in a YAML file named scc_admin.yaml:

   SecurityContextConstraints object definition

   kind: SecurityContextConstraints
   apiVersion: security.openshift.io/v1
   metadata:
     name: scc-admin
   allowPrivilegedContainer: true
   runAsUser:
     type: RunAsAny
   seLinuxContext:
     type: RunAsAny
   fsGroup:
     type: RunAsAny
   supplementalGroups:
     type: RunAsAny
   users:
   - my-admin-user
   groups:
   - my-admin-group

   Optionally, you can specify drop capabilities for an SCC by setting the requiredDropCapabilities field with the desired values. Any specified capabilities are dropped from the container. For example, to create an SCC with the KILL, MKNOD, and SYS_CHROOT required drop capabilities, add the following to the SCC object:

   requiredDropCapabilities:
   - KILL
   - MKNOD
   - SYS_CHROOT

   CRI-O supports the same list of capability values that are found in the Docker documentation.

2. Create the SCC by passing in the file:

   $ oc create -f scc_admin.yaml

   Example output

   securitycontextconstraints "scc-admin" created