Commit Graph

7 Commits

Author SHA1 Message Date
Arnaud Porterie
ad8bce2ce4 Merge pull request #18959 from justincormack/finit_module
Deny finit_module in default seccomp profile
2015-12-29 10:12:50 -08:00
Arnaud Porterie
8ac3d083a8 Merge pull request #18961 from justincormack/clock_adjtime
Block clock_adjtime in default seccomp config
2015-12-29 10:08:45 -08:00
Justin Cormack
6300a08be9 Block stime in default seccomp profile
The stime syscall is a legacy syscall on some architectures
to set the clock, should be blocked as time is not namespaced.

Signed-off-by: Justin Cormack <justin.cormack@unikernel.com>
2015-12-29 15:28:05 +00:00
Justin Cormack
0e5c43cdda Block clock_adjtime in default seccomp config
clock_adjtime is the new posix style version of adjtime allowing
a specific clock to be specified. Time is not namespaced, so do
not allow.

Signed-off-by: Justin Cormack <justin.cormack@unikernel.com>
2015-12-29 12:48:16 +00:00
Justin Cormack
0d5306a0b6 Deny finit_module in default seccomp profile
This is a new version of init_module that takes a file descriptor
rather than a file name.

Signed-off-by: Justin Cormack <justin.cormack@unikernel.com>
2015-12-29 12:31:33 +00:00
Jessica Frazelle
b4c14a0bb8 fix code comment
Signed-off-by: Jessica Frazelle <acidburn@docker.com>
2015-12-28 22:36:54 -08:00
Jessica Frazelle
947293a280 set default seccomp profile
Signed-off-by: Jessica Frazelle <acidburn@docker.com>
2015-12-28 10:18:47 -08:00