remove docker-unconfined profile we were not using it and it breaks apparmor on wheezy
Signed-off-by: Jessica Frazelle <acidburn@docker.com> Upstream-commit: e542238f2a4ba9d77bf8ebc77e319dd6b321925f Component: engine
This commit is contained in:
@ -59,21 +59,6 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) {
|
||||
deny /sys/firmware/efi/efivars/** rwklx,
|
||||
deny /sys/kernel/security/** rwklx,
|
||||
}
|
||||
|
||||
profile docker-unconfined flags=(attach_disconnected,mediate_deleted,complain) {
|
||||
#include <abstractions/base>
|
||||
|
||||
network,
|
||||
capability,
|
||||
file,
|
||||
umount,
|
||||
mount,
|
||||
pivot_root,
|
||||
change_profile -> *,
|
||||
|
||||
ptrace,
|
||||
signal,
|
||||
}
|
||||
`
|
||||
|
||||
func generateProfile(out io.Writer) error {
|
||||
|
||||
@ -58,7 +58,7 @@ func NewDriver(root, initPath string, options []string) (*Driver, error) {
|
||||
|
||||
if apparmor.IsEnabled() {
|
||||
if err := installAppArmorProfile(); err != nil {
|
||||
apparmorProfiles := []string{"docker-default", "docker-unconfined"}
|
||||
apparmorProfiles := []string{"docker-default"}
|
||||
|
||||
// Allow daemon to run if loading failed, but are active
|
||||
// (possibly through another run, manually, or via system startup)
|
||||
|
||||
Reference in New Issue
Block a user