Justin Cormack c726c9026e Block additional ptrace related syscalls in default seccomp profile ...

Block kcmp, procees_vm_readv, process_vm_writev.
All these require CAP_PTRACE, and are only used for ptrace related
actions, so are not useful as we block ptrace.

Signed-off-by: Justin Cormack <justin.cormack@unikernel.com>
Upstream-commit: a0a8ca0ae0bc9dc7faa0b8bacf4ca376c7257348
Component: engine

2015-12-29 18:17:28 +00:00

components/engine

Block additional ptrace related syscalls in default seccomp profile

2015-12-29 18:17:28 +00:00

S

Description

The Docker CLI

clidocker

360 MiB

Languages

Go 92.3%

Shell 5.4%

Dockerfile 1.1%

Go-Checksums 0.7%

Makefile 0.3%

Other 0.2%