Merge pull request #18959 from justincormack/finit_module

Deny finit_module in default seccomp profile
2015-12-29 10:12:50 -08:00 · 2015-12-29 10:12:50 -08:00 · ad8bce2ce4
commit ad8bce2ce4
parent 8ac3d083a8 0d5306a0b6
1 changed files with 6 additions and 0 deletions
--- a/daemon/execdriver/native/seccomp_default.go
+++ b/daemon/execdriver/native/seccomp_default.go
@ -77,6 +77,12 @@ var defaultSeccompProfile = &configs.Seccomp{
 			Action: configs.Errno,
 			Args:   []*configs.Arg{},
 		},
+		{
+			// Deny manipulation and functions on kernel modules.
+			Name:   "finit_module",
+			Action: configs.Errno,
+			Args:   []*configs.Arg{},
+		},
 		{
 			// Deny retrieval of exported kernel and module symbols
 			Name:   "get_kernel_syms",