[docker-iccpd] limit privileged flag for iccpd container

[maipbui]

Why I did it

HLD implementation: Container Hardening (sonic-net/SONiC#1364)

Work item tracking

• Microsoft ADO (number only): 14807420

How I did it

Reduce linux capabilities in privileged flag

How to verify it

Check container's settings: Privileged is false and container only has default Linux caps, does not have extended caps.

admin@vlab-01:~$ docker inspect iccpd | grep Privi
            "Privileged": false,


admin@vlab-01:~$ docker exec -it iccpd bash
root@vlab-01:/# capsh --print
Current: cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap=ep

Which release branch to backport (provide reason below if selected)

• 201811
• 201911
• 202006
• 202012
• 202106
• 202111
• 202205
• 202211
• 202305

Tested branch (Please provide the tested image version)

Description for the changelog

Link to config_db schema for YANG module changes

A picture of a cute animal (not mandatory but encouraged)

[qiluo-msft]

@shine4chen Could you help review?

[puffc]

Is it possible to add --cap-add=NET_ADMIN? Iccpd needs to execute ebtables command to add/remove isolation group rules into nf_table.

[TafkaMax]

Is it possible to add --cap-add=NET_ADMIN? Iccpd needs to execute ebtables command to add/remove isolation group rules into nf_table.

This should do the trick for testing?
$(DOCKER_ICCPD)_RUN_OPT += --cap-add=NET_ADMIN -t