InTheForest/moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2026-01-11 10:41:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

seccomp: Require CAP_SYS_ADMIN for lsm_* syscalls

Browse Source 
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
This commit is contained in:
Paweł Gronowski
2025-05-28 11:22:50 +02:00
parent 0ab8108b57
commit 148a19b6d6
2 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
profiles/seccomp/default.json
View File

@@ -208,9 +208,6 @@
"lremovexattr",
"lseek",
"lsetxattr",
"lsm_get_self_attr",
"lsm_list_modules",
"lsm_set_self_attrs",
"lstat",
"lstat64",
"madvise",
@@ -614,6 +611,9 @@
"fsopen",
"fspick",
"lookup_dcookie",
"lsm_get_self_attr",
"lsm_list_modules",
"lsm_set_self_attr",
"mount",
"mount_setattr",
"move_mount",

6
profiles/seccomp/default_linux.go
View File

@@ -200,9 +200,6 @@ func DefaultProfile() *Seccomp {
"lremovexattr",
"lseek",
"lsetxattr",
"lsm_get_self_attr", // kernel v6.8, libseccomp v2.6.0
"lsm_list_modules", // kernel v6.8, libseccomp v2.6.0
"lsm_set_self_attr", // kernel v6.8, libseccomp v2.6.0
"lstat",
"lstat64",
"madvise",
@@ -605,6 +602,9 @@ func DefaultProfile() *Seccomp {
"fsopen",
"fspick",
"lookup_dcookie",
"lsm_get_self_attr", // kernel v6.8, libseccomp v2.6.0
"lsm_list_modules", // kernel v6.8, libseccomp v2.6.0
"lsm_set_self_attr", // kernel v6.8, libseccomp v2.6.0
"mount",
"mount_setattr",
"move_mount",