kotovalexarian-likes-github/moby--moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Code Releases Activity

Deny finit_module in default seccomp profile

Browse source 
This is a new version of init_module that takes a file descriptor
rather than a file name.

Signed-off-by: Justin Cormack <justin.cormack@unikernel.com>
This commit is contained in:
Justin Cormack 2015-12-29 12:31:33 +00:00
parent eb551baf6f
commit 0d5306a0b6
1 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
daemon/execdriver/native/seccomp_default.go
View file

@ -71,6 +71,12 @@ var defaultSeccompProfile = &configs.Seccomp{
Action: configs.Errno, Action: configs.Errno,
Args: []*configs.Arg{}, Args: []*configs.Arg{},
}, },
{
// Deny manipulation and functions on kernel modules.
Name: "finit_module",
Action: configs.Errno,
Args: []*configs.Arg{},
},
{ {
// Deny retrieval of exported kernel and module symbols // Deny retrieval of exported kernel and module symbols
Name: "get_kernel_syms", Name: "get_kernel_syms",