beenull/moby
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
moby/profiles/seccomp
History
Justin Cormack 265f7a37bd Gate name_to_handle_at by CAP_SYS_ADMIN not CAP_DAC_READ_SEARCH 
Only open_by_handle_at requires CAP_DAC_READ_SEARCH.

This allows systemd to run with only `--cap-add SYS_ADMIN`
rather than having to also add `--cap-add DAC_READ_SEARCH`
as well which it does not really need.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
(cherry picked from commit c1ca124682)
Signed-off-by: Tibor Vass <tibor@docker.com>
2016-08-11 17:56:50 -07:00
..
fixtures move default seccomp profile into package 2016-01-21 16:55:29 -08:00
default.json Move mlock back into the default ungated seccomp profile 2016-06-16 23:36:53 -07:00
generate.go Align default seccomp profile with selected capabilities 2016-05-11 09:30:23 +01:00
seccomp.go Align default seccomp profile with selected capabilities 2016-05-11 09:30:23 +01:00
seccomp_default.go Gate name_to_handle_at by CAP_SYS_ADMIN not CAP_DAC_READ_SEARCH 2016-08-11 17:56:50 -07:00
seccomp_test.go add seccomp default profile fix tests 2016-02-19 13:32:54 -08:00
seccomp_unsupported.go Align default seccomp profile with selected capabilities 2016-05-11 09:30:23 +01:00