kotovalexarian-likes-github/moby--moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Code Releases Activity

Merge pull request #18393 from qzio/apparmor/ptrace-ubuntu14

Browse source 
Enable ptrace in a container on apparmor below 2.9
This commit is contained in:
Jess Frazelle 2015-12-14 10:07:01 -08:00
commit c38aa60180
1 changed files with 4 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
daemon/execdriver/native/apparmor.go
View file

@ -60,12 +60,13 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) {
deny /sys/firmware/efi/efivars/** rwklx,
deny /sys/kernel/security/** rwklx,
{{if ge .MajorVersion 2}}{{if ge .MinorVersion 8}}
# suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
ptrace (trace,read) peer=docker-default,
{{end}}{{end}}
{{if ge .MajorVersion 2}}{{if ge .MinorVersion 9}}
# docker daemon confinement requires explict allow rule for signal
signal (receive) set=(kill,term) peer={{.ExecPath}},
# suppress ptrace denails when using 'docker ps'
ptrace (trace,read) peer=docker-default,
{{end}}{{end}}
}
`