anchor.diff:  [[creating-new-security-context-constraints]]
   == Creating New Security Context Constraints
   
  -To create a new SCC, first define the SCC in a JSON or YAML file:
  -
  +To create a new SCC: 
  +
  +. Define the SCC in a JSON or YAML file:
  ++
   .Security Context Constraint Object Definition
   ====
   ----
  
positive.code:     Ranges:					<none>
    Supplemental Groups Strategy: RunAsAny
      Ranges:					<none>
  ====
  
  ifdef::openshift-enterprise,openshift-origin[]
  
negative.code: - my-admin-group
  ----
  ====
  +
  Optionally, you can add drop capabilities to an SCC by setting the
  `*requiredDropCapabilities:*` field with the desired values. Any specified
  capabilities will be dropped from the container. For example, to create an SCC
  with the `*KILL*`, `*MKNOD*`, and `*SYS_CHROOT*` required drop capabilities, add
  the following to the SCC object:
  +
  ====
  ----
  requiredDropCapabilities:
  - KILL
  - MKNOD
  - SYS_CHROOT
  ----
  ====
  +
  You can see the list of possible values in the
  link:https://docs.docker.com/engine/reference/run/#/runtime-privilege-and-linux-capabilities[Docker
  documentation].
  
  . Then, run `oc create` passing the file to create it:
  +
  ====
  ----
  $ oc create -f scc_admin.yaml
  securitycontextconstraints/scc-admin
  ----
  ====
  
  . Verify that the SCC was created:
  +
  ====
  ----
  $ oc get scc
  NAME         PRIV      CAPS      HOSTDIR   SELINUX     RUNASUSER
  privileged   true      []        true      RunAsAny    RunAsAny
  