| Ryan Tidwell | 2201953 | 2019-04-12 10:23:47 -0500 | [diff] [blame] | 1 | #include <tunables/global> |
| 2 | |
| 3 | profile docker-default flags=(attach_disconnected,mediate_deleted) { |
| 4 | |
| 5 | #include <abstractions/base> |
| 6 | |
| 7 | network, |
| 8 | capability, |
| 9 | file, |
| 10 | umount, |
| 11 | |
| 12 | deny @{PROC}/* w, # deny write for all files directly in /proc (not in a subdir) |
| 13 | # deny write to files not in /proc/<number>/** or /proc/sys/** |
| 14 | deny @{PROC}/{[^1-9],[^1-9][^0-9],[^1-9s][^0-9y][^0-9s],[^1-9][^0-9][^0-9][^0-9]*}/** w, |
| 15 | deny @{PROC}/sys/[^k]** w, # deny /proc/sys except /proc/sys/k* (effectively /proc/sys/kernel) |
| 16 | deny @{PROC}/sys/kernel/{?,??,[^s][^h][^m]**} w, # deny everything except shm* in /proc/sys/kernel/ |
| 17 | deny @{PROC}/sysrq-trigger rwklx, |
| 18 | deny @{PROC}/mem rwklx, |
| 19 | deny @{PROC}/kmem rwklx, |
| 20 | deny @{PROC}/kcore rwklx, |
| 21 | |
| 22 | deny mount, |
| 23 | |
| 24 | deny /sys/[^f]*/** wklx, |
| 25 | deny /sys/f[^s]*/** wklx, |
| 26 | deny /sys/fs/[^c]*/** wklx, |
| 27 | deny /sys/fs/c[^g]*/** wklx, |
| 28 | deny /sys/fs/cg[^r]*/** wklx, |
| 29 | deny /sys/firmware/efi/efivars/** rwklx, |
| 30 | deny /sys/kernel/security/** rwklx, |
| 31 | |
| 32 | # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container |
| 33 | ptrace (trace,read) peer=docker-default, |
| 34 | } |