From 76e5020b106e14284f63bd7cee81822ad6b1fbf0 Mon Sep 17 00:00:00 2001 From: Joshua Schmid Date: Mon, 14 Sep 2020 10:38:07 +0200 Subject: [PATCH] cephadm: capadd and privileged are mutex Signed-off-by: Joshua Schmid --- src/cephadm/cephadm | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/cephadm/cephadm b/src/cephadm/cephadm index 83c860ef18d..7f78ab91492 100755 --- a/src/cephadm/cephadm +++ b/src/cephadm/cephadm @@ -2535,9 +2535,11 @@ class CephContainer: cmd_args.extend([ '--privileged', # let OSD etc read block devs that haven't been chowned - '--group-add=disk', - ]) - if self.ptrace: + '--group-add=disk']) + if self.ptrace and not self.privileged: + # if privileged, the SYS_PTRACE cap is already added + # in addition, --cap-add and --privileged are mutually + # exclusive since podman >= 2.0 cmd_args.append('--cap-add=SYS_PTRACE') if self.init: cmd_args.append('--init')