anchor.diff:  restricted   false     []        false     MustRunAs   MustRunAsRange
   ----
   ====
  +
  +[[examining-a-security-context-constraints-object]]
  +
  +== Examining a Security Context Constraints Object
  +
  +To examine a particular SCC, use `oc get`, `oc describe`, `oc export`, or `oc edit`.
  +
  +====
  +----
  +$ oc edit scc restricted
  +allowHostDirVolumePlugin: false
  +allowHostNetwork: false
  +allowHostPorts: false
  +allowPrivilegedContainer: false
  +allowedCapabilities: null
  +apiVersion: v1
  +groups:
  +- system:authenticated
  +kind: SecurityContextConstraints
  +metadata:
  +  creationTimestamp: 2015-09-08T07:37:54Z
  +  name: restricted <1>
  +  resourceVersion: "58"
  +  selfLink: /api/v1/securitycontextconstraints/restricted
  +  uid: 849d9228-55fc-11e5-976b-080027c5bfa9
  +runAsUser:
  +  type: MustRunAsRange
  +seLinuxContext:
  +  type: MustRunAs
  +----
  +<1> The SCC name specified in the `oc edit` command.
  +====
  +
   
   [[creating-new-security-context-constraints]]
   
  
positive.code: groups:
  - my-admin-group
  ----
  ====
  
  Then, run `oc create` passing the file to create it:
  
negative.code: 
  ====
  
  [[grant-a-service-account-access-to-the-privileged-scc]]
  
  === Grant a Service Account Access to the Privileged SCC
  
  First, create a link:../dev_guide/service_accounts.html[service account].
  For example, to create service account `My_SVCACCT` in project `My_Project`:
  
  ====
  ----
  $ cat <<EOF | oc create -n My_Project -f -
  kind: ServiceAccount
  apiVersion: v1
  metadata:
    name: My_SVCACCT <1>
  EOF
  ----
  ====
  
  Then, add the service account to the `privileged` SCC.
  
  ----
  $ oc edit scc privileged
  ----
  
  Add the following under `users`:
  
  ----
     - system:serviceaccount:My_Project:My_SVCACCT
  ----
  
  [[enable-images-to-run-with-user-in-the-dockerfile]]
  
  === Enable Images to Run with USER in the Dockerfile
  