From e02645b0cd500a83d0b518ee45f533ea230b45a9 Mon Sep 17 00:00:00 2001 From: Justin Cormack Date: Tue, 29 Dec 2015 11:57:16 +0000 Subject: [PATCH] Block original umount syscall in default seccomp filter The original umount syscall without flags argument needs to be blocked too. Signed-off-by: Justin Cormack Upstream-commit: 9be0d93cf74d1bb31c401f1154abc773af31cbd6 Component: engine --- .../engine/daemon/execdriver/native/seccomp_default.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/components/engine/daemon/execdriver/native/seccomp_default.go b/components/engine/daemon/execdriver/native/seccomp_default.go index 1075a0b315..8f348dbc51 100644 --- a/components/engine/daemon/execdriver/native/seccomp_default.go +++ b/components/engine/daemon/execdriver/native/seccomp_default.go @@ -298,6 +298,12 @@ var defaultSeccompProfile = &configs.Seccomp{ Action: configs.Errno, Args: []*configs.Arg{}, }, + { + // Deny umount + Name: "umount", + Action: configs.Errno, + Args: []*configs.Arg{}, + }, { // Deny umount Name: "umount2",