chiark / gitweb /
~ianmdlvl / elogind.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 840295f) | patch
nspawn: block open_by_handle_at() and others via seccomp
authorLennart Poettering <lennart@poettering.net>
Mon, 30 Jun 2014 14:22:12 +0000 (16:22 +0200)
committerLennart Poettering <lennart@poettering.net>
Mon, 30 Jun 2014 14:22:12 +0000 (16:22 +0200)
commit28650077f36466d9c5ee27ef2006fae3171a2430
tree4775b637711114e0e2f99dcc7248641873965242tree | snapshot
parent840295fc1e30bb8902e8df08127bbc281318b537commit | diff
nspawn: block open_by_handle_at() and others via seccomp

Let's protect ourselves against the recently reported docker security
issue. Our man page makes clear that we do not make any security
promises anyway, but well, this one is easy to mitigate, so let's do it.
While we are at it block a couple of more syscalls that are no good in
containers, too.
src/nspawn/nspawn.c diff | blob | history
Unnamed repository; edit this file 'description' to name the repository.