mirror of
https://github.com/clearlinux/docker.git
synced 2026-09-04 20:51:44 +00:00
revert apparmor changes back to how it was in 1.7.1, but keep tests
Signed-off-by: Jessica Frazelle <acidburn@docker.com>
(cherry picked from commit ed248207d7)
This commit is contained in:
committed by
David Calavera
parent
da4b336233
commit
5916664220
@@ -40,20 +40,16 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) {
|
||||
file,
|
||||
umount,
|
||||
|
||||
signal (receive) peer=/usr/bin/docker,
|
||||
signal (receive) peer=docker-unconfined,
|
||||
|
||||
deny @{PROC}/sys/fs/** wklx,
|
||||
deny @{PROC}/fs/** wklx,
|
||||
deny @{PROC}/sysrq-trigger rwklx,
|
||||
deny @{PROC}/mem rwklx,
|
||||
deny @{PROC}/kmem rwklx,
|
||||
deny @{PROC}/kore rwklx,
|
||||
deny @{PROC}/kcore rwklx,
|
||||
deny @{PROC}/sys/kernel/[^s][^h][^m]* wklx,
|
||||
deny @{PROC}/sys/kernel/*/** wklx,
|
||||
|
||||
deny mount,
|
||||
deny ptrace (trace) peer=docker-default,
|
||||
|
||||
deny /sys/[^f]*/** wklx,
|
||||
deny /sys/f[^s]*/** wklx,
|
||||
|
||||
@@ -198,9 +198,8 @@ func (d *driver) setPrivileged(container *configs.Config) (err error) {
|
||||
container.Devices = hostDevices
|
||||
|
||||
if apparmor.IsEnabled() {
|
||||
container.AppArmorProfile = "docker-unconfined"
|
||||
container.AppArmorProfile = "unconfined"
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user