mir/lxc
2
0
Fork 0
mirror of git://github.com/lxc/lxc synced 2025-08-31 03:09:34 +00:00
Code Issues Releases Wiki Activity

[aa-profile] Deny access to /proc/acpi/**

Browse Source 
Signed-off-by: Pierre-Elliott Bécue <becue@crans.org>
This commit is contained in:
Pierre-Elliott Bécue
2019-08-10 22:07:42 +02:00
parent 772900e7d2
commit ec90f35b4c
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
config/apparmor/abstractions/container-base.in
View File

@@ -73,6 +73,7 @@
# block some other dangerous paths # block some other dangerous paths
deny @{PROC}/kcore rwklx, deny @{PROC}/kcore rwklx,
deny @{PROC}/sysrq-trigger rwklx, deny @{PROC}/sysrq-trigger rwklx,
deny @{PROC}/acpi/** rwklx,
# deny writes in /sys except for /sys/fs/cgroup, also allow # deny writes in /sys except for /sys/fs/cgroup, also allow
# fusectl, securityfs and debugfs to be mounted there (read-only) # fusectl, securityfs and debugfs to be mounted there (read-only)