cad393d146
This call is what is used to implement `dmesg` to get kernel messages about the host. This can leak substantial information about the host. It is normally available to unprivileged users on the host, unless the sysctl `kernel.dmesg_restrict = 1` is set, but this is not set by standard on the majority of distributions. Blocking this to restrict leaks about the configuration seems correct. Fix #37897 See also https://googleprojectzero.blogspot.com/2018/09/a-cache-invalidation-bug-in-linux.html Signed-off-by: Justin Cormack <justin.cormack@docker.com> (cherry picked from commit ccd22ffcc8b564dfc21e7067b5248819d68c56c6) Signed-off-by: Sebastiaan van Stijn <github@gone.nl> Upstream-commit: 16836e60bc87abb3e9ab16f33c2038931c1d473b Component: engine