Che plugin container security spec

Summary

Hi, I am currently looking into creating a chePlugin which requires a custom container with the IPC_LOCK security context set. The current chePlugin specification does not expose any container security configuration. I think we can work around the current state by instead using a type: kubernetes component block in the our stack’s devfile, however, handling this in the chePlugin YAML spec would be ideal.

Are there any plans to add container security configuration to the chePlugin YAML spec?

[MarkAckert]

I agree generalized privileged escalation is a security risk.

I didn’t specify this well in my initial question, but I’m interested in specific security capabilities, not general privilege escalation. I don’t know enough about Linux capabilities to determine if they’re an equal security risk to the general escalation case, or if some subset would be allowable.

And to bring my question to the real use case - we have a plugin which stores encrypted credentials, and we use keytar for that. The gnome-keyring daemon underpinning keytar requires IPC_LOCK to prevent credentials being paged off to disk.

[che-bot]

Issues go stale after 180 days of inactivity. lifecycle/stale issues rot after an additional 7 days of inactivity and eventually close.

Mark the issue as fresh with /remove-lifecycle stale in a new comment.

If this issue is safe to close now please do so.

Moderators: Add lifecycle/frozen label to avoid stale mode.