starred/cli
1
0
Fork 0
mirror of https://github.com/docker/cli.git synced 2026-09-24 07:25:07 -05:00
Code Issues Packages Projects Releases Wiki Activity

No not mount sysfs by default for non privilged containers

Browse Source 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
Upstream-commit: 81e5026a6afb282589704fd5f6bcac9ed50108ea
Component: engine
This commit is contained in:
Michael Crosby
2014-04-24 10:35:20 -07:00
parent bdab73285c
commit 20ba5d97da
5 changed files with 66 additions and 289 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/engine/daemon/execdriver/lxc/lxc_template.go
+2
View File
@@ -88,7 +88,9 @@ lxc.mount.entry = proc {{escapeFstabSpaces $ROOTFS}}/proc proc nosuid,nodev,noex
# WARNING: sysfs is a known attack vector and should probably be disabled
# if your userspace allows it. eg. see http://bit.ly/T9CkqJ
{{if .Privileged}}
lxc.mount.entry = sysfs {{escapeFstabSpaces $ROOTFS}}/sys sysfs nosuid,nodev,noexec 0 0
{{end}}
{{if .Tty}}
lxc.mount.entry = {{.Console}} {{escapeFstabSpaces $ROOTFS}}/dev/console none bind,rw 0 0