mirror of
https://github.com/moby/moby.git
synced 2022-11-09 12:21:53 -05:00
d92739713c
This makes the type better reflect the difference with the "runtime" profile;
our local type is used to generate a runtime-spec seccomp profile and extends
the runtime-spec type with additional fields; adding a "Name" field for backward
compatibility with older JSON representations, additional "Comment" metadata,
and conditional rules ("Includes", "Excludes") used during generation to adjust
the profile based on the container (capabilities) and host's (architecture, kernel)
configuration.
This change introduces one change in the type; the "runtime-spec" type uses a
`[]LinuxSeccompArg` for the `Args` field, whereas the local type used pointers;
`[]*LinuxSeccompArg`.
In addition, the runtime-spec Syscall type brings a new `ErrnoRet` field, allowing
the profile to specify the errno code returned for the syscall, which allows
changing the default EPERM for specific syscalls.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
33 lines
753 B
JSON
33 lines
753 B
JSON
{
|
|
"defaultAction": "SCMP_ACT_ERRNO",
|
|
"syscalls": [
|
|
{
|
|
"name": "clone",
|
|
"action": "SCMP_ACT_ALLOW",
|
|
"args": [
|
|
{
|
|
"index": 0,
|
|
"value": 2114060288,
|
|
"valueTwo": 0,
|
|
"op": "SCMP_CMP_MASKED_EQ"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"name": "open",
|
|
"action": "SCMP_ACT_ALLOW",
|
|
"args": []
|
|
},
|
|
{
|
|
"name": "close",
|
|
"action": "SCMP_ACT_ALLOW",
|
|
"args": []
|
|
},
|
|
{
|
|
"name": "syslog",
|
|
"action": "SCMP_ACT_ERRNO",
|
|
"errnoRet": 12345,
|
|
"args": []
|
|
}
|
|
]
|
|
}
|