Revert "Introduce a dedicated unconfined AA policy"
This reverts commit 87376c3add
.
Signed-off-by: David Calavera <david.calavera@gmail.com>
This commit is contained in:
parent
5ab4b60e11
commit
94ab0d312f
|
@ -23,15 +23,3 @@ profile docker-default flags=(attach_disconnected,mediate_deleted) {
|
||||||
deny /sys/firmware/efi/efivars/** rwklx,
|
deny /sys/firmware/efi/efivars/** rwklx,
|
||||||
deny /sys/kernel/security/** rwklx,
|
deny /sys/kernel/security/** rwklx,
|
||||||
}
|
}
|
||||||
|
|
||||||
profile docker-unconfined flags=(attach_disconnected,mediate_deleted) {
|
|
||||||
#include <abstractions/base>
|
|
||||||
|
|
||||||
network,
|
|
||||||
capability,
|
|
||||||
file,
|
|
||||||
umount,
|
|
||||||
mount,
|
|
||||||
pivot_root,
|
|
||||||
change_profile -> *,
|
|
||||||
}
|
|
||||||
|
|
|
@ -198,7 +198,7 @@ func (d *driver) setPrivileged(container *configs.Config) (err error) {
|
||||||
container.Devices = hostDevices
|
container.Devices = hostDevices
|
||||||
|
|
||||||
if apparmor.IsEnabled() {
|
if apparmor.IsEnabled() {
|
||||||
container.AppArmorProfile = "docker-unconfined"
|
container.AppArmorProfile = "unconfined"
|
||||||
}
|
}
|
||||||
|
|
||||||
return nil
|
return nil
|
||||||
|
|
Loading…
Reference in New Issue