beenull/moby
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge pull request from GHSA-jq35-85cj-fj4p

Browse source 
[master] deny /sys/devices/virtual/powercap
This commit is contained in:
Sebastiaan van Stijn 2023-10-25 23:57:51 +02:00 committed by GitHub
commit c9ccbfad11
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 2 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
oci/defaults.go
View file

@ -113,6 +113,7 @@ func DefaultLinuxSpec() specs.Spec {
"/proc/sched_debug", "/proc/sched_debug",
"/proc/scsi", "/proc/scsi",
"/sys/firmware", "/sys/firmware",
"/sys/devices/virtual/powercap",
}, },
ReadonlyPaths: []string{ ReadonlyPaths: []string{
"/proc/bus", "/proc/bus",

1
profiles/apparmor/template.go
View file

@ -46,6 +46,7 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) {
deny /sys/fs/c[^g]*/** wklx, deny /sys/fs/c[^g]*/** wklx,
deny /sys/fs/cg[^r]*/** wklx, deny /sys/fs/cg[^r]*/** wklx,
deny /sys/firmware/** rwklx, deny /sys/firmware/** rwklx,
deny /sys/devices/virtual/powercap/** rwklx,
deny /sys/kernel/security/** rwklx, deny /sys/kernel/security/** rwklx,
# suppress ptrace denials when using 'docker ps' or using 'ps' inside a container # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container