5 commits

Author	SHA1	Message	Date
Vincent Demeester	1858656925	Move TearDownTest cleaning to environment package ... Signed-off-by: Vincent Demeester <vincent@sbr.pm>	2017-03-01 21:04:11 +01:00
Justin Cormack	7e3a596a63	Block obsolete socket families in the default seccomp profile ... Linux supports many obsolete address families, which are usually available in common distro kernels, but they are less likely to be properly audited and may have security issues This blocks all socket families in the socket (and socketcall where applicable) syscall except - AF_UNIX - Unix domain sockets - AF_INET - IPv4 - AF_INET6 - IPv6 - AF_NETLINK - Netlink sockets for communicating with the ekrnel - AF_PACKET - raw sockets, which are only allowed with CAP_NET_RAW All other socket families are blocked, including Appletalk (native, not over IP), IPX (remember that!), VSOCK and HVSOCK, which should not generally be used in containers, etc. Note that users can of course provide a profile per container or in the daemon config if they have unusual use cases that require these. Signed-off-by: Justin Cormack <justin.cormack@docker.com>	2017-01-17 17:50:44 +00:00
Vincent Demeester	c8016e669f	Use testEnv methods and remove most of the global variables ... Signed-off-by: Vincent Demeester <vincent@sbr.pm>	2017-01-17 12:39:08 +01:00
Vincent Demeester	33968e6c7d	Remove pkg/integration and move it to testutil or integration-cli ... Signed-off-by: Vincent Demeester <vincent@sbr.pm>	2016-12-30 18:26:34 +01:00
Vincent Demeester	433e2e8a1e	Introduce a environment package in integration-cli ... Signed-off-by: Vincent Demeester <vincent@sbr.pm>	2016-12-29 11:00:50 +01:00

Renamed from integration-cli/fixtures_linux_daemon.go (Browse further)