search

opencontainers / runtime-tools

OCI Runtime Tools
https://www.opencontainers.org/
Apache License 2.0
434 stars 141 forks source link

seccomp: add CloneNewCgroup to check sysCloneFlagsIndex #694

Closed KentaTada closed 2 years ago

KentaTada commented 5 years ago

All clone flags should be denied as default profile. Also x/sys should be used instead of syscall.

Signed-off-by: Kenta Tada Kenta.Tada@sony.com

KentaTada commented 5 years ago

I don't understand why pullapprove was failed but I signed off. Could you take a look at this commit?

KentaTada commented 5 years ago

FYI, @vbatts @crosbymichael This commit is related to below.
https://github.com/containerd/containerd/pull/3314 https://github.com/moby/moby/pull/39308

kolyshkin commented 2 years ago

@KentaTada can you please rebase this?

KentaTada commented 2 years ago

Rebased. Thanks.

kolyshkin commented 2 years ago

close/reopen to kick ci