toolshed/docker-cli
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

apparmor: prohibit /sys/firmware/** from being accessed

Browse Source 
Some firmware information including SMBIOS and ACPI tables were unexpectedly exposed

Signed-off-by: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>
Upstream-commit: 693b4ac67ad0638be9defbae771f62d860380f31
Component: engine
This commit is contained in:
Akihiro Suda
2016-09-16 02:21:31 +00:00
parent 4efffd499d
commit 23bac4b64f
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/engine/docs/security/apparmor.md
+2 -2
View File
@@ -59,7 +59,7 @@ profile docker-default flags=(attach_disconnected,mediate_deleted) {
deny /sys/fs/[^c]*/** wklx,
deny /sys/fs/c[^g]*/** wklx,
deny /sys/fs/cg[^r]*/** wklx,
deny /sys/firmware/efi/efivars/** rwklx,
deny /sys/firmware/** rwklx,
deny /sys/kernel/security/** rwklx,
}
```
@@ -175,7 +175,7 @@ profile docker-nginx flags=(attach_disconnected,mediate_deleted) {
deny /sys/fs/[^c]*/** wklx,
deny /sys/fs/c[^g]*/** wklx,
deny /sys/fs/cg[^r]*/** wklx,
deny /sys/firmware/efi/efivars/** rwklx,
deny /sys/firmware/** rwklx,
deny /sys/kernel/security/** rwklx,
}
```
components/engine/profiles/apparmor/template.go
+1 -1
View File
@@ -35,7 +35,7 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) {
deny /sys/fs/[^c]*/** wklx,
deny /sys/fs/c[^g]*/** wklx,
deny /sys/fs/cg[^r]*/** wklx,
deny /sys/firmware/efi/efivars/** rwklx,
deny /sys/firmware/** rwklx,
deny /sys/kernel/security/** rwklx,
{{if ge .Version 208095}}