mirror of
https://github.com/moby/moby.git
synced 2022-11-09 12:21:53 -05:00
26 lines
570 B
Text
26 lines
570 B
Text
|
#include <tunables/global>
|
||
|
|
|
||
|
|
profile docker-default flags=(attach_disconnected,mediate_deleted) {
|
||
|
|
#include <abstractions/base>
|
||
|
|
|
||
|
|
network,
|
||
|
|
capability,
|
||
|
|
file,
|
||
|
|
umount,
|
||
|
|
|
||
|
|
deny @{PROC}/sys/fs/** wklx,
|
||
|
|
deny @{PROC}/sysrq-trigger rwklx,
|
||
|
|
deny @{PROC}/sys/kernel/[^s][^h][^m]* wklx,
|
||
|
|
deny @{PROC}/sys/kernel/*/** wklx,
|
||
|
|
|
||
|
|
deny mount,
|
||
|
|
|
||
|
|
deny /sys/[^f]*/** wklx,
|
||
|
|
deny /sys/f[^s]*/** wklx,
|
||
|
|
deny /sys/fs/[^c]*/** wklx,
|
||
|
|
deny /sys/fs/c[^g]*/** wklx,
|
||
|
|
deny /sys/fs/cg[^r]*/** wklx,
|
||
|
|
deny /sys/firmware/efi/efivars/** rwklx,
|
||
|
|
deny /sys/kernel/security/** rwklx,
|
||
|
|
}
|