0ct0pu5/moby
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge pull request #23593 from justincormack/mlock

Browse source 
Move mlock back into the default ungated seccomp profile
This commit is contained in:
Arnaud Porterie 2016-06-16 05:16:57 +00:00 • committed by GitHub
commit 78d624cfcd
2 changed files with 30 additions and 18 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
profiles/seccomp/default.json
View file

@ -686,6 +686,21 @@
"action": "SCMP_ACT_ALLOW",
"args": []
},
{
"name": "mlock",
"action": "SCMP_ACT_ALLOW",
"args": []
},
{
"name": "mlock2",
"action": "SCMP_ACT_ALLOW",
"args": []
},
{
"name": "mlockall",
"action": "SCMP_ACT_ALLOW",
"args": []
},
{
"name": "mmap",
"action": "SCMP_ACT_ALLOW",

33
profiles/seccomp/seccomp_default.go
View file

@ -721,6 +721,21 @@ func DefaultProfile(rs *specs.Spec) *types.Seccomp {
Action: types.ActAllow,
Args: []*types.Arg{},
},
{
Name: "mlock",
Action: types.ActAllow,
Args: []*types.Arg{},
},
{
Name: "mlock2",
Action: types.ActAllow,
Args: []*types.Arg{},
},
{
Name: "mlockall",
Action: types.ActAllow,
Args: []*types.Arg{},
},
{
Name: "mmap",
Action: types.ActAllow,
@ -1663,24 +1678,6 @@ func DefaultProfile(rs *specs.Spec) *types.Seccomp {
Args: []*types.Arg{},
},
}...)
case "CAP_IPC_LOCK":
syscalls = append(syscalls, []*types.Syscall{
{
Name: "mlock",
Action: types.ActAllow,
Args: []*types.Arg{},
},
{
Name: "mlock2",
Action: types.ActAllow,
Args: []*types.Arg{},
},
{
Name: "mlockall",
Action: types.ActAllow,
Args: []*types.Arg{},
},
}...)
case "CAP_SYS_ADMIN":
capSysAdmin = true
syscalls = append(syscalls, []*types.Syscall{