From 0e5c43cddad304301ca8a82f652e15f75ee68cfe Mon Sep 17 00:00:00 2001 From: Justin Cormack Date: Tue, 29 Dec 2015 12:48:16 +0000 Subject: [PATCH] Block clock_adjtime in default seccomp config clock_adjtime is the new posix style version of adjtime allowing a specific clock to be specified. Time is not namespaced, so do not allow. Signed-off-by: Justin Cormack --- daemon/execdriver/native/seccomp_default.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/daemon/execdriver/native/seccomp_default.go b/daemon/execdriver/native/seccomp_default.go index 1075a0b315..177aa983c1 100644 --- a/daemon/execdriver/native/seccomp_default.go +++ b/daemon/execdriver/native/seccomp_default.go @@ -28,6 +28,12 @@ var defaultSeccompProfile = &configs.Seccomp{ Action: configs.Errno, Args: []*configs.Arg{}, }, + { + // Time/Date is not namespaced + Name: "clock_adjtime", + Action: configs.Errno, + Args: []*configs.Arg{}, + }, { // Time/Date is not namespaced Name: "clock_settime",