Modify privileged SCC to allow to use all capabilities

api/swagger-spec/openshift-openapi-spec.json

@@ -55440,7 +55440,7 @@
       "type": "boolean"
      },
      "allowedCapabilities": {
-      "description": "AllowedCapabilities is a list of capabilities that can be requested to add to the container. Capabilities in this field maybe added at the pod author's discretion. You must not list a capability in both AllowedCapabilities and RequiredDropCapabilities.",
+      "description": "AllowedCapabilities is a list of capabilities that can be requested to add to the container. Capabilities in this field maybe added at the pod author's discretion. You must not list a capability in both AllowedCapabilities and RequiredDropCapabilities. To allow all capabilities you may use '*'.",
       "type": "array",
       "items": {
        "type": "string"

pkg/cmd/server/bootstrappolicy/securitycontextconstraints.go

@@ -64,6 +64,7 @@ func GetBootstrapSecurityContextConstraints(sccNameToAdditionalGroups map[string
 				},
 			},
 			AllowPrivilegedContainer: true,
+			AllowedCapabilities:      []kapi.Capability{kapi.CapabilityAll},
 			Volumes:                  []kapi.FSType{kapi.FSTypeAll},
 			AllowHostNetwork:         true,
 			AllowHostPorts:           true,

pkg/openapi/zz_generated.openapi.go

@@ -21916,7 +21916,7 @@ var OpenAPIDefinitions *common.OpenAPIDefinitions = &common.OpenAPIDefinitions{
 					},
 					"allowedCapabilities": {
 						SchemaProps: spec.SchemaProps{
-							Description: "AllowedCapabilities is a list of capabilities that can be requested to add to the container. Capabilities in this field maybe added at the pod author's discretion. You must not list a capability in both AllowedCapabilities and RequiredDropCapabilities.",
+							Description: "AllowedCapabilities is a list of capabilities that can be requested to add to the container. Capabilities in this field maybe added at the pod author's discretion. You must not list a capability in both AllowedCapabilities and RequiredDropCapabilities. To allow all capabilities you may use '*'.",
 							Type:        []string{"array"},
 							Items: &spec.SchemaOrArray{
 								Schema: &spec.Schema{

pkg/security/admission/admission_test.go

@@ -49,6 +49,10 @@ func TestAdmitCaps(t *testing.T) {
 	requiresFooToBeDropped.Name = "requireDrop"
 	requiresFooToBeDropped.RequiredDropCapabilities = []kapi.Capability{"foo"}
 
+	allowAllInAllowed := restrictiveSCC()
+	allowAllInAllowed.Name = "allowAllCapsInAllowed"
+	allowAllInAllowed.AllowedCapabilities = []kapi.Capability{kapi.CapabilityAll}
+
 	tc := map[string]struct {
 		pod                  *kapi.Pod
 		sccs                 []*kapi.SecurityContextConstraints
@@ -108,6 +112,12 @@ func TestAdmitCaps(t *testing.T) {
 				Drop: []kapi.Capability{"foo"},
 			},
 		},
+		// UC 8: using '*' in allowed caps
+		"should accept cap add when all caps are allowed": {
+			pod:        createPodWithCaps(&kapi.Capabilities{Add: []kapi.Capability{"foo"}}),
+			sccs:       []*kapi.SecurityContextConstraints{restricted, allowAllInAllowed},
+			shouldPass: true,
+		},
 	}
 
 	for i := 0; i < 2; i++ {