whitelist CNI binaries

kubernetes-sigs · Dec 20, 2019 · 281a20c · 281a20c
1 parent f9868d4
commit 281a20c
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/images/base/Dockerfile b/images/base/Dockerfile
@@ -94,6 +94,12 @@ RUN echo "Ensuring scripts are executable ..." \
  && mkdir -p /opt/cni/bin \
  && tar -C /opt/cni/bin -xzf /tmp/cni.tgz \
  && rm -rf /tmp/cni.tgz \
+ && find /opt/cni/bin -type f -not \( \
+ -iname host-local \
+ -o -iname ptp \
+ -o -iname portmap \
+ -o -iname loopback \
+ \) \
  && echo "Ensuring /etc/kubernetes/manifests" \
  && mkdir -p /etc/kubernetes/manifests \
  && echo "Adjusting systemd-tmpfiles timer" \