@@ -18956,6 +18956,7 @@

      "requiredDropCapabilities",

      "allowedCapabilities",

      "allowHostDirVolumePlugin",

+     "volumes",

      "allowHostNetwork",

      "allowHostPorts",

      "allowHostPID",

@@ -19008,6 +19009,12 @@

       "type": "boolean",

       "description": "AllowHostDirVolumePlugin determines if the policy allow containers to use the HostDir volume plugin"

      },

+     "volumes": {

+      "type": "array",

+      "items": {

+       "$ref": "v1.FSType"

+      }

+     },

      "allowHostNetwork": {

       "type": "boolean",

       "description": "AllowHostNetwork determines if the policy allows the use of HostNetwork in the pod spec."

@@ -19060,6 +19067,10 @@

      }

     }

    },

+   "v1.FSType": {

+    "id": "v1.FSType",

+    "properties": {}

+   },

    "v1.SELinuxContextStrategyOptions": {

     "id": "v1.SELinuxContextStrategyOptions",

     "description": "SELinuxContextStrategyOptions defines the strategy type and any options used to create the strategy.",

@@ -15,7 +15,7 @@ func TestComputeDefinitions(t *testing.T) {

 	diffCaps.AllowedCapabilities = []kapi.Capability{"foo"}

 	diffHostDir := goodSCC()

-	diffHostDir.AllowHostDirVolumePlugin = true

+	diffHostDir.Volumes = []kapi.FSType{kapi.FSTypeHostPath}

 	diffHostNetwork := goodSCC()

 	diffHostNetwork.AllowHostNetwork = true

@@ -64,7 +64,7 @@ func GetBootstrapSecurityContextConstraints(sccNameToAdditionalGroups map[string

 				},

 			},

 			AllowPrivilegedContainer: true,

-			AllowHostDirVolumePlugin: true,

+			Volumes:                  []kapi.FSType{kapi.FSTypeAll},

 			AllowHostNetwork:         true,

 			AllowHostPorts:           true,

 			AllowHostPID:             true,

@@ -91,6 +91,7 @@ func GetBootstrapSecurityContextConstraints(sccNameToAdditionalGroups map[string

 					DescriptionAnnotation: SecurityContextConstraintNonRootDesc,

 				},

 			},

+			Volumes: []kapi.FSType{kapi.FSTypeEmptyDir, kapi.FSTypeSecret, kapi.FSTypeDownwardAPI, kapi.FSTypeConfigMap},

 			SELinuxContext: kapi.SELinuxContextStrategyOptions{

 				// This strategy requires that annotations on the namespace which will be populated

 				// by the admission controller.  If namespaces are not annotated creating the strategy

@@ -118,7 +119,7 @@ func GetBootstrapSecurityContextConstraints(sccNameToAdditionalGroups map[string

 					DescriptionAnnotation: SecurityContextConstraintHostMountAndAnyUIDDesc,

 				},

 			},

-			AllowHostDirVolumePlugin: true,

+			Volumes: []kapi.FSType{kapi.FSTypeHostPath, kapi.FSTypeEmptyDir, kapi.FSTypeSecret, kapi.FSTypeDownwardAPI, kapi.FSTypeConfigMap},

 			SELinuxContext: kapi.SELinuxContextStrategyOptions{

 				// This strategy requires that annotations on the namespace which will be populated

 				// by the admission controller.  If namespaces are not annotated creating the strategy

@@ -147,11 +148,11 @@ func GetBootstrapSecurityContextConstraints(sccNameToAdditionalGroups map[string

 					DescriptionAnnotation: SecurityContextConstraintHostNSDesc,

 				},

 			},

-			AllowHostDirVolumePlugin: true,

-			AllowHostNetwork:         true,

-			AllowHostPorts:           true,

-			AllowHostPID:             true,

-			AllowHostIPC:             true,

+			Volumes:          []kapi.FSType{kapi.FSTypeHostPath, kapi.FSTypeEmptyDir, kapi.FSTypeSecret, kapi.FSTypeDownwardAPI, kapi.FSTypeConfigMap},

+			AllowHostNetwork: true,

+			AllowHostPorts:   true,

+			AllowHostPID:     true,

+			AllowHostIPC:     true,

 			SELinuxContext: kapi.SELinuxContextStrategyOptions{

 				// This strategy requires that annotations on the namespace which will be populated

 				// by the admission controller.  If namespaces are not annotated creating the strategy

@@ -179,6 +180,7 @@ func GetBootstrapSecurityContextConstraints(sccNameToAdditionalGroups map[string

 					DescriptionAnnotation: SecurityContextConstraintRestrictedDesc,

 				},

 			},

+			Volumes: []kapi.FSType{kapi.FSTypeEmptyDir, kapi.FSTypeSecret, kapi.FSTypeDownwardAPI, kapi.FSTypeConfigMap},

 			SELinuxContext: kapi.SELinuxContextStrategyOptions{

 				// This strategy requires that annotations on the namespace which will be populated

 				// by the admission controller.  If namespaces are not annotated creating the strategy

@@ -208,6 +210,7 @@ func GetBootstrapSecurityContextConstraints(sccNameToAdditionalGroups map[string

 					DescriptionAnnotation: SecurityContextConstraintsAnyUIDDesc,

 				},

 			},

+			Volumes: []kapi.FSType{kapi.FSTypeEmptyDir, kapi.FSTypeSecret, kapi.FSTypeDownwardAPI, kapi.FSTypeConfigMap},

 			SELinuxContext: kapi.SELinuxContextStrategyOptions{

 				// This strategy requires that annotations on the namespace which will be populated

 				// by the admission controller.  If namespaces are not annotated creating the strategy

@@ -238,6 +241,7 @@ func GetBootstrapSecurityContextConstraints(sccNameToAdditionalGroups map[string

 			},

 			AllowHostNetwork: true,

 			AllowHostPorts:   true,

+			Volumes:          []kapi.FSType{kapi.FSTypeEmptyDir, kapi.FSTypeSecret, kapi.FSTypeDownwardAPI, kapi.FSTypeConfigMap},

 			SELinuxContext: kapi.SELinuxContextStrategyOptions{

 				// This strategy requires that annotations on the namespace which will be populated

 				// by the admission controller.  If namespaces are not annotated creating the strategy

@@ -27,7 +27,7 @@ func TestByPrioritiesScore(t *testing.T) {

 	nonPriviledSCC := testSCC("nonprivileged", 1)

 	hostDirSCC := testSCC("hostdir", 1)

-	hostDirSCC.AllowHostDirVolumePlugin = true

+	hostDirSCC.Volumes = []kapi.FSType{kapi.FSTypeHostPath}

 	sccs := []*kapi.SecurityContextConstraints{nonPriviledSCC, privilegedSCC, hostDirSCC}

 	// with equal priorities expect that the SCCs will be sorted with hold behavior based on their score,

@@ -24,11 +24,9 @@ func pointValue(constraint *kapi.SecurityContextConstraints) int {

 	if constraint.AllowPrivilegedContainer {

 		points += 20

 	}

-	// 9 gives us a value slightly higher than an SCC that allows run as any in both strategies since

-	// we're allowing access to the host system

-	if constraint.AllowHostDirVolumePlugin {

-		points += 10

-	}

+

+	// add points based on volume requests

+	points += volumePointValue(constraint)

 	// strategies in order of least restrictive to most restrictive

 	switch constraint.SELinuxContext.Type {

@@ -50,3 +48,37 @@ func pointValue(constraint *kapi.SecurityContextConstraints) int {

 	}

 	return points

 }

+

+// allowsHostPathVolume returns a score based on the volumes allowed by the SCC.

+// Allowing a host volume wil return a score of 10.  Allowance of anything other

+// than kapi.FSTypeSecret, kapi.FSTypeConfigMap, kapi.FSTypeConfigMap, kapi.FSTypeDownwardAPI

+// will result in a score of 5.  If the SCC only allows kapi.FSTypeSecret, kapi.FSTypeConfigMap,

+// kapi.FSTypeEmptyDir, kapi.FSTypeDownwardAPI it will have a score of 0.

+func volumePointValue(scc *kapi.SecurityContextConstraints) int {

+	hasHostVolume := false

+	hasNonTrivialVolume := false

+	for _, v := range scc.Volumes {

+		switch v {

+		case kapi.FSTypeHostPath, kapi.FSTypeAll:

+			hasHostVolume = true

+			// nothing more to do, this is the max point value

+			break

+		// it is easier to specifically list the trivial volumes and allow the

+		// default case to be non-trivial so we don't have to worry about adding

+		// volumes in the future unless they're trivial.

+		case kapi.FSTypeSecret, kapi.FSTypeConfigMap,

+			kapi.FSTypeEmptyDir, kapi.FSTypeDownwardAPI:

+			// do nothing

+		default:

+			hasNonTrivialVolume = true

+		}

+	}

+

+	if hasHostVolume {

+		return 10

+	}

+	if hasNonTrivialVolume {

+		return 5

+	}

+	return 0

+}

new file mode 100644

@@ -0,0 +1,162 @@

+package admission

+

+import (

+	"testing"

+

+	kapi "k8s.io/kubernetes/pkg/api"

+)

+

+func TestPointValue(t *testing.T) {

+	newSCC := func(priv bool, seLinuxStrategy kapi.SELinuxContextStrategyType, userStrategy kapi.RunAsUserStrategyType) *kapi.SecurityContextConstraints {

+		scc := &kapi.SecurityContextConstraints{

+			SELinuxContext: kapi.SELinuxContextStrategyOptions{

+				Type: seLinuxStrategy,

+			},

+			RunAsUser: kapi.RunAsUserStrategyOptions{

+				Type: userStrategy,

+			},

+		}

+		if priv {

+			scc.AllowPrivilegedContainer = true

+		}

+

+		return scc

+	}

+

+	seLinuxStrategies := map[kapi.SELinuxContextStrategyType]int{

+		kapi.SELinuxStrategyRunAsAny:  4,

+		kapi.SELinuxStrategyMustRunAs: 1,

+	}

+	userStrategies := map[kapi.RunAsUserStrategyType]int{

+		kapi.RunAsUserStrategyRunAsAny:         4,

+		kapi.RunAsUserStrategyMustRunAsNonRoot: 3,

+		kapi.RunAsUserStrategyMustRunAsRange:   2,

+		kapi.RunAsUserStrategyMustRunAs:        1,

+	}

+

+	privilegedPoints := 20

+

+	// run through all combos of user strategy + seLinux strategy + priv

+	for userStrategy, userStrategyPoints := range userStrategies {

+		for seLinuxStrategy, seLinuxStrategyPoints := range seLinuxStrategies {

+			expectedPoints := privilegedPoints + userStrategyPoints + seLinuxStrategyPoints

+			scc := newSCC(true, seLinuxStrategy, userStrategy)

+			actualPoints := pointValue(scc)

+

+			if actualPoints != expectedPoints {

+				t.Errorf("privileged, user: %v, seLinux %v expected %d score but got %d", userStrategy, seLinuxStrategy, expectedPoints, actualPoints)

+			}

+

+			expectedPoints = userStrategyPoints + seLinuxStrategyPoints

+			scc = newSCC(false, seLinuxStrategy, userStrategy)

+			actualPoints = pointValue(scc)

+

+			if actualPoints != expectedPoints {

+				t.Errorf("non privileged, user: %v, seLinux %v expected %d score but got %d", userStrategy, seLinuxStrategy, expectedPoints, actualPoints)

+			}

+		}

+	}

+

+	// sanity check to ensure volume score is added (specific volumes scores are tested below

+	scc := newSCC(false, kapi.SELinuxStrategyMustRunAs, kapi.RunAsUserStrategyMustRunAs)

+	scc.Volumes = []kapi.FSType{kapi.FSTypeHostPath}

+	actualPoints := pointValue(scc)

+	if actualPoints != 12 { //1 (SELinux) + 1 (User) + 10 (host path volume)

+		t.Errorf("volume score was not added to the scc point value correctly!")

+	}

+}

+

+func TestVolumePointValue(t *testing.T) {

+	newSCC := func(host, nonTrivial, trivial bool) *kapi.SecurityContextConstraints {

+		volumes := []kapi.FSType{}

+		if host {

+			volumes = append(volumes, kapi.FSTypeHostPath)

+		}

+		if nonTrivial {

+			volumes = append(volumes, kapi.FSTypeAWSElasticBlockStore)

+		}

+		if trivial {

+			volumes = append(volumes, kapi.FSTypeSecret)

+		}

+		return &kapi.SecurityContextConstraints{

+			Volumes: volumes,

+		}

+	}

+

+	allowAllSCC := &kapi.SecurityContextConstraints{

+		Volumes: []kapi.FSType{kapi.FSTypeAll},

+	}

+	nilVolumeSCC := &kapi.SecurityContextConstraints{}

+

+	tests := map[string]struct {

+		scc            *kapi.SecurityContextConstraints

+		expectedPoints int

+	}{

+		"all volumes": {

+			scc:            allowAllSCC,

+			expectedPoints: 10,

+		},

+		"host volume": {

+			scc:            newSCC(true, false, false),

+			expectedPoints: 10,

+		},

+		"host volume and non trivial volumes": {

+			scc:            newSCC(true, true, false),

+			expectedPoints: 10,

+		},

+		"host volume, non trivial, and trivial": {

+			scc:            newSCC(true, true, true),

+			expectedPoints: 10,

+		},

+		"non trivial": {

+			scc:            newSCC(false, true, false),

+			expectedPoints: 5,

+		},

+		"non trivial and trivial": {

+			scc:            newSCC(false, true, true),

+			expectedPoints: 5,

+		},

+		"trivial": {

+			scc:            newSCC(false, false, true),

+			expectedPoints: 0,

+		},

+		"trivial - secret": {

+			scc: &kapi.SecurityContextConstraints{

+				Volumes: []kapi.FSType{kapi.FSTypeSecret},

+			},

+			expectedPoints: 0,

+		},

+		"trivial - configMap": {

+			scc: &kapi.SecurityContextConstraints{

+				Volumes: []kapi.FSType{kapi.FSTypeConfigMap},

+			},

+			expectedPoints: 0,

+		},

+		"trivial - emptyDir": {

+			scc: &kapi.SecurityContextConstraints{

+				Volumes: []kapi.FSType{kapi.FSTypeEmptyDir},

+			},

+			expectedPoints: 0,

+		},

+		"trivial - downwardAPI": {

+			scc: &kapi.SecurityContextConstraints{

+				Volumes: []kapi.FSType{kapi.FSTypeDownwardAPI},

+			},

+			expectedPoints: 0,

+		},

+		"no volumes allowed": {

+			scc:            newSCC(false, false, false),

+			expectedPoints: 0,

+		},

+		"nil volumes": {

+			scc:            nilVolumeSCC,

+			expectedPoints: 0,

+		},

+	}

+	for k, v := range tests {

+		actualPoints := volumePointValue(v.scc)

+		if actualPoints != v.expectedPoints {

+			t.Errorf("%s expected %d volume score but got %d", k, v.expectedPoints, actualPoints)

+		}

+	}

+}