starred/cli
1
0
Fork 0
mirror of https://github.com/docker/cli.git synced 2026-09-24 07:25:07 -05:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #18971 from justincormack/ptrace

Browse Source 
Block additional ptrace related syscalls in default seccomp profile
Upstream-commit: e01cab1cc5c7f92747a479b5480ca78f7fc37101
Component: engine
This commit is contained in:
Arnaud Porterie
2015-12-29 11:56:51 -08:00
parent 33e38a216c c726c9026e
commit ed8f5303d0
1 changed files with 21 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/engine/daemon/execdriver/native/seccomp_default.go
+21
View File
@@ -117,6 +117,13 @@ var defaultSeccompProfile = &configs.Seccomp{
Action: configs.Errno,
Args: []*configs.Arg{},
},
{
// Restrict process inspection capabilities
// Already blocked by dropping CAP_PTRACE
Name: "kcmp",
Action: configs.Errno,
Args: []*configs.Arg{},
},
{
// Sister syscall of kexec_load that does the same thing,
// slightly different arguments
@@ -215,6 +222,20 @@ var defaultSeccompProfile = &configs.Seccomp{
Action: configs.Errno,
Args: []*configs.Arg{},
},
{
// Restrict process inspection capabilities
// Already blocked by dropping CAP_PTRACE
Name: "process_vm_readv",
Action: configs.Errno,
Args: []*configs.Arg{},
},
{
// Restrict process modification capabilities
// Already blocked by dropping CAP_PTRACE
Name: "process_vm_writev",
Action: configs.Errno,
Args: []*configs.Arg{},
},
{
// Already blocked by dropping CAP_PTRACE
Name: "ptrace",