|
@@ -24,14 +24,12 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) {
|
|
capability,
|
|
capability,
|
|
file,
|
|
file,
|
|
umount,
|
|
umount,
|
|
-{{if ge .Version 208096}}
|
|
|
|
# Host (privileged) processes may send signals to container processes.
|
|
# Host (privileged) processes may send signals to container processes.
|
|
signal (receive) peer=unconfined,
|
|
signal (receive) peer=unconfined,
|
|
# dockerd may send signals to container processes (for "docker kill").
|
|
# dockerd may send signals to container processes (for "docker kill").
|
|
signal (receive) peer={{.DaemonProfile}},
|
|
signal (receive) peer={{.DaemonProfile}},
|
|
# Container processes may send signals amongst themselves.
|
|
# Container processes may send signals amongst themselves.
|
|
signal (send,receive) peer={{.Name}},
|
|
signal (send,receive) peer={{.Name}},
|
|
-{{end}}
|
|
|
|
|
|
|
|
deny @{PROC}/* w, # deny write for all files directly in /proc (not in a subdir)
|
|
deny @{PROC}/* w, # deny write for all files directly in /proc (not in a subdir)
|
|
# deny write to files not in /proc/<number>/** or /proc/sys/**
|
|
# deny write to files not in /proc/<number>/** or /proc/sys/**
|
|
@@ -51,9 +49,7 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) {
|
|
deny /sys/firmware/** rwklx,
|
|
deny /sys/firmware/** rwklx,
|
|
deny /sys/kernel/security/** rwklx,
|
|
deny /sys/kernel/security/** rwklx,
|
|
|
|
|
|
-{{if ge .Version 208095}}
|
|
|
|
# suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
|
|
# suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
|
|
ptrace (trace,read,tracedby,readby) peer={{.Name}},
|
|
ptrace (trace,read,tracedby,readby) peer={{.Name}},
|
|
-{{end}}
|
|
|
|
}
|
|
}
|
|
`
|
|
`
|