Merge pull request #18956 from justincormack/umount

Block original umount syscall in default seccomp filter
2026-03-27 14:28:47 +07:00 · 2015-12-29 10:19:04 -08:00
parent 3ec3597d58 9be0d93cf7
commit a32b06b067
1 changed files with 6 additions and 0 deletions
--- a/daemon/execdriver/native/seccomp_default.go
+++ b/daemon/execdriver/native/seccomp_default.go
@@ -316,6 +316,12 @@ var defaultSeccompProfile = &configs.Seccomp{
 			Action: configs.Errno,
 			Args:   []*configs.Arg{},
 		},
+		{
+			// Deny umount
+			Name:   "umount",
+			Action: configs.Errno,
+			Args:   []*configs.Arg{},
+		},
 		{
 			// Deny umount
 			Name:   "umount2",