From 70ad19f2e684a08a00435d8899c015ccdfe793e1 Mon Sep 17 00:00:00 2001 From: Tycho Andersen Date: Fri, 6 Oct 2017 09:11:59 -0600 Subject: [PATCH] drop useless apparmor denies These files don't exist under proc so this rule does nothing. They are protected against by docker's default cgroup devices since they're both character devices and not explicitly allowed. Signed-off-by: Tycho Andersen Upstream-commit: b4a6ccbc5fe695062111cad5a20bb3d0ac5a94db Component: engine --- components/engine/profiles/apparmor/template.go | 2 -- 1 file changed, 2 deletions(-) diff --git a/components/engine/profiles/apparmor/template.go b/components/engine/profiles/apparmor/template.go index c5ea4584de..741da9c264 100644 --- a/components/engine/profiles/apparmor/template.go +++ b/components/engine/profiles/apparmor/template.go @@ -24,8 +24,6 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) { deny @{PROC}/sys/[^k]** w, # deny /proc/sys except /proc/sys/k* (effectively /proc/sys/kernel) deny @{PROC}/sys/kernel/{?,??,[^s][^h][^m]**} w, # deny everything except shm* in /proc/sys/kernel/ deny @{PROC}/sysrq-trigger rwklx, - deny @{PROC}/mem rwklx, - deny @{PROC}/kmem rwklx, deny @{PROC}/kcore rwklx, deny mount,