From 9be0d93cf74d1bb31c401f1154abc773af31cbd6 Mon Sep 17 00:00:00 2001
From: Justin Cormack <justin.cormack@unikernel.com>
Date: Tue, 29 Dec 2015 11:57:16 +0000
Subject: [PATCH] Block original umount syscall in default seccomp filter

The original umount syscall without flags argument needs to
be blocked too.

Signed-off-by: Justin Cormack <justin.cormack@unikernel.com>
---
 daemon/execdriver/native/seccomp_default.go | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/daemon/execdriver/native/seccomp_default.go b/daemon/execdriver/native/seccomp_default.go
index 1075a0b315..8f348dbc51 100644
--- a/daemon/execdriver/native/seccomp_default.go
+++ b/daemon/execdriver/native/seccomp_default.go
@@ -298,6 +298,12 @@ var defaultSeccompProfile = &configs.Seccomp{
 			Action: configs.Errno,
 			Args:   []*configs.Arg{},
 		},
+		{
+			// Deny umount
+			Name:   "umount",
+			Action: configs.Errno,
+			Args:   []*configs.Arg{},
+		},
 		{
 			// Deny umount
 			Name:   "umount2",