toolshed/docker-cli
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #26618 from AkihiroSuda/fix-apparmor

Browse Source 
apparmor: prohibit /sys/firmware/** from being accessed
Upstream-commit: 07b5311147c319a003324e8f26ceb829ed5cc240
Component: engine
This commit is contained in:
Kenfe-Mickaël Laventure
2016-09-16 07:41:36 -07:00
committed by GitHub
parent 9566044db8 23bac4b64f
commit a7caeb2743
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
components/engine/docs/security/apparmor.md
View File

@ -59,7 +59,7 @@ profile docker-default flags=(attach_disconnected,mediate_deleted) {
deny /sys/fs/[^c]*/** wklx,
deny /sys/fs/c[^g]*/** wklx,
deny /sys/fs/cg[^r]*/** wklx,
deny /sys/firmware/efi/efivars/** rwklx,
deny /sys/firmware/** rwklx,
deny /sys/kernel/security/** rwklx,
}
```
@ -175,7 +175,7 @@ profile docker-nginx flags=(attach_disconnected,mediate_deleted) {
deny /sys/fs/[^c]*/** wklx,
deny /sys/fs/c[^g]*/** wklx,
deny /sys/fs/cg[^r]*/** wklx,
deny /sys/firmware/efi/efivars/** rwklx,
deny /sys/firmware/** rwklx,
deny /sys/kernel/security/** rwklx,
}
```

2
components/engine/profiles/apparmor/template.go
View File

@ -35,7 +35,7 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) {
deny /sys/fs/[^c]*/** wklx,
deny /sys/fs/c[^g]*/** wklx,
deny /sys/fs/cg[^r]*/** wklx,
deny /sys/firmware/efi/efivars/** rwklx,
deny /sys/firmware/** rwklx,
deny /sys/kernel/security/** rwklx,
{{if ge .Version 208095}}