Add noexec nodev and nosuid to sandbox /etc/resolv.conf mount bind.

vinayakankugoyal · vinayakankugoyal · commit ae4dbb60d5e3 · 2023-03-24T21:56:53.000Z
Signed-off-by: Vinayak Goyal &lt;vinaygo@google.com&gt;
diff --git a/pkg/cri/server/sandbox_run_linux.go b/pkg/cri/server/sandbox_run_linux.go
@@ -133,7 +133,7 @@ func (c *criService) sandboxContainerSpec(id string, config *runtime.PodSandboxC
 			Source:      c.getResolvPath(id),
 			Destination: resolvConfPath,
 			Type:        "bind",
-			Options:     []string{"rbind", "ro"},
+			Options:     []string{"rbind", "ro", "nosuid", "nodev", "noexec"},
 		},
 	}))
 
