kotovalexarian-likes-github/moby--moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Code Releases Activity

Merge pull request #14855 from ewindisch/apparmor-unconfined

Browse source 
Introduce a dedicated unconfined AA policy
This commit is contained in:
David Calavera 2015-07-23 10:21:51 -07:00
commit ac9fc03c74
2 changed files with 13 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
contrib/apparmor/docker
View file

@ -23,3 +23,15 @@ profile docker-default flags=(attach_disconnected,mediate_deleted) {
deny /sys/firmware/efi/efivars/** rwklx, deny /sys/firmware/efi/efivars/** rwklx,
deny /sys/kernel/security/** rwklx, deny /sys/kernel/security/** rwklx,
} }
profile docker-unconfined flags=(attach_disconnected,mediate_deleted) {
#include <abstractions/base>
network,
capability,
file,
umount,
mount,
pivot_root,
change_profile -> *,
}

2
daemon/execdriver/native/create.go
View file

@ -198,7 +198,7 @@ func (d *driver) setPrivileged(container *configs.Config) (err error) {
container.Devices = hostDevices container.Devices = hostDevices
if apparmor.IsEnabled() { if apparmor.IsEnabled() {
container.AppArmorProfile = "unconfined" container.AppArmorProfile = "docker-unconfined"
} }
return nil return nil