0ct0pu5/moby
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Remove mlock and vhangup from the default seccomp profile

Browse source 
These syscalls are already blocked by the default capabilities:
mlock mlock2 mlockall require CAP_IPC_LOCK
vhangup requires CAP_SYS_TTY_CONFIG

There is therefore no reason to allow them in the default profile
as they cannot be used anyway.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
This commit is contained in:
Justin Cormack 2016-04-21 18:23:59 +01:00
parent 228759fd42
commit e7a99ae5e1
2 changed files with 0 additions and 40 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
profiles/seccomp/default.json
View file

@ -713,21 +713,6 @@
"action": "SCMP_ACT_ALLOW",
"args": []
},
{
"name": "mlock",
"action": "SCMP_ACT_ALLOW",
"args": []
},
{
"name": "mlock2",
"action": "SCMP_ACT_ALLOW",
"args": []
},
{
"name": "mlockall",
"action": "SCMP_ACT_ALLOW",
"args": []
},
{
"name": "mmap",
"action": "SCMP_ACT_ALLOW",
@ -1564,11 +1549,6 @@
"action": "SCMP_ACT_ALLOW",
"args": []
},
{
"name": "vhangup",
"action": "SCMP_ACT_ALLOW",
"args": []
},
{
"name": "vmsplice",
"action": "SCMP_ACT_ALLOW",

20
profiles/seccomp/seccomp_default.go
View file

@ -745,21 +745,6 @@ var DefaultProfile = &types.Seccomp{
Action: types.ActAllow,
Args: []*types.Arg{},
},
{
Name: "mlock",
Action: types.ActAllow,
Args: []*types.Arg{},
},
{
Name: "mlock2",
Action: types.ActAllow,
Args: []*types.Arg{},
},
{
Name: "mlockall",
Action: types.ActAllow,
Args: []*types.Arg{},
},
{
Name: "mmap",
Action: types.ActAllow,
@ -1593,11 +1578,6 @@ var DefaultProfile = &types.Seccomp{
Action: types.ActAllow,
Args: []*types.Arg{},
},
{
Name: "vhangup",
Action: types.ActAllow,
Args: []*types.Arg{},
},
{
Name: "vmsplice",
Action: types.ActAllow,