hostnetwork SCC takes precedence over restricted for a pod that doesn't request host network

[php-coder]

Extracted from https://github.com/openshift/origin/pull/15923/files#r134773733:

Steps To Reproduce

$ oc cluster up
$ oc login -u system:admin
$ oc adm policy add-scc-to-user hostnetwork developer
$ oc login -u developer -p developer
$ $ cat testing-nope-pod.yaml 
kind: Pod
apiVersion: v1
metadata:
  generateName: testing-pod-
spec:
  restartPolicy: Never
  containers:
  - name: test-pod
	image: busybox
	command:
	- id
$ oc create -f testing-nope-pod.yaml
pod "testing-pod-ff9zw" created

Current Result

$ oc get pod testing-pod-ff9zw -o yaml | grep scc
	openshift.io/scc: hostnetwork

Expected Result

$ oc get pod testing-pod-ff9zw -o yaml | grep scc
	openshift.io/scc: restricted

Workaround

oc patch scc restricted -p '{"priority":1}'

CC @openshift/sig-security

[php-coder]

It doesn't compromise security because 1) a user should have access to the hostnetwork SCC anyway 2) while hostnetwork allows host ports and host network it doesn't mutates a pod to set it as default values. In fact the pods that were created by these SCCs look the same.

[adelton]

@pweil- Are we sure that hostnetwork is the only thing from whatever can be set for SCC (see https://github.com/openshift/origin/blob/master/pkg/security/apis/security/types.go#L18) which isn't yet covered by https://github.com/openshift/origin/blob/master/pkg/security/securitycontextconstraints/byrestrictions.go, apart from capabilities which we plan to cover by #14825?

I'd like to cover everything which might affect the score, not add individual things when we uncover them.

[adelton]

In #16231, I now consider both AllowHostNetwork and AllowHostPorts.