moby--moby/profiles/seccomp/seccomp_unsupported.go

// +build linux,!seccomp

package seccomp

import (
	"github.com/docker/engine-api/types"
	"github.com/opencontainers/runtime-spec/specs-go"
)

// DefaultProfile returns a nil pointer on unsupported systems.
func DefaultProfile(rs *specs.Spec) *types.Seccomp {
	return nil
}
fix default profile where unsupported Signed-off-by: Jessica Frazelle <acidburn@docker.com> 2015-12-29 03:24:44 +00:00			`// +build linux,!seccomp`

move default seccomp profile into package Signed-off-by: Jessica Frazelle <acidburn@docker.com> 2016-01-19 22:57:03 +00:00			`package seccomp`
fix default profile where unsupported Signed-off-by: Jessica Frazelle <acidburn@docker.com> 2015-12-29 03:24:44 +00:00
Align default seccomp profile with selected capabilities Currently the default seccomp profile is fixed. This changes it so that it varies depending on the Linux capabilities selected with the --cap-add and --cap-drop options. Without this, if a user adds privileges, eg to allow ptrace with --cap-add sys_ptrace then still cannot actually use ptrace as it is still blocked by seccomp, so they will probably disable seccomp or use --privileged. With this change the syscalls that are needed for the capability are also allowed by the seccomp profile based on the selected capabilities. While this patch makes it easier to do things with for example cap_sys_admin enabled, as it will now allow creating new namespaces and use of mount, it still allows less than --cap-add cap_sys_admin --security-opt seccomp:unconfined would have previously. It is not recommended that users run containers with cap_sys_admin as this does give full access to the host machine. It also cleans up some architecture specific system calls to be only selected when needed. Signed-off-by: Justin Cormack <justin.cormack@docker.com> 2016-05-06 14:17:41 +00:00			`import (`
			`"github.com/docker/engine-api/types"`
Replace old oci specs import with runtime-specs Fixes #25804 The upstream repo changed the import paths. Signed-off-by: Michael Crosby <crosbymichael@gmail.com> 2016-08-17 16:38:34 +00:00			`"github.com/opencontainers/runtime-spec/specs-go"`
fix default profile where unsupported Signed-off-by: Jessica Frazelle <acidburn@docker.com> 2015-12-29 03:24:44 +00:00			`)`
Align default seccomp profile with selected capabilities Currently the default seccomp profile is fixed. This changes it so that it varies depending on the Linux capabilities selected with the --cap-add and --cap-drop options. Without this, if a user adds privileges, eg to allow ptrace with --cap-add sys_ptrace then still cannot actually use ptrace as it is still blocked by seccomp, so they will probably disable seccomp or use --privileged. With this change the syscalls that are needed for the capability are also allowed by the seccomp profile based on the selected capabilities. While this patch makes it easier to do things with for example cap_sys_admin enabled, as it will now allow creating new namespaces and use of mount, it still allows less than --cap-add cap_sys_admin --security-opt seccomp:unconfined would have previously. It is not recommended that users run containers with cap_sys_admin as this does give full access to the host machine. It also cleans up some architecture specific system calls to be only selected when needed. Signed-off-by: Justin Cormack <justin.cormack@docker.com> 2016-05-06 14:17:41 +00:00
			`// DefaultProfile returns a nil pointer on unsupported systems.`
			`func DefaultProfile(rs specs.Spec) types.Seccomp {`
			`return nil`
			`}`