opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-07-25 09:05:00 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #8669 from giuseppe/unmask-also-cover-ro-paths

Browse Source 
security: honor systempaths=unconfined for ro paths
This commit is contained in:
OpenShift Merge Robot
2020-12-09 15:04:41 -05:00
committed by GitHub
parent 4511cb3852 176be90e0a
commit 059c2ee739
4 changed files with 23 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
docs/source/markdown/podman-create.1.md
View File

@ -854,8 +854,8 @@ Security Options
- `seccomp=profile.json` : White listed syscalls seccomp Json file to be used as a seccomp filter
- `unmask=ALL or /path/1:/path/2` : Paths to unmask separated by a colon. If set to **ALL**, it will
unmask all the paths that are masked by default.
The default masked paths are **/proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux.**
unmask all the paths that are masked or made read only by default.
The default masked paths are **/proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux.** The default paths that are read only are **/proc/asound, /proc/bus, /proc/fs, /proc/irq, /proc/sys, /proc/sysrq-trigger**.
- `proc-opts=OPTIONS` : Comma separated list of options to use for the /proc mount. More details for the
possible mount options are specified at **proc(5)** man page.

4
docs/source/markdown/podman-run.1.md
View File

@ -896,8 +896,8 @@ Security Options
- **proc-opts**=_OPTIONS_ : Comma separated list of options to use for the /proc mount. More details
for the possible mount options are specified at **proc(5)** man page.
- **unmask**=_ALL_ or _/path/1:/path/2_: Paths to unmask separated by a colon. If set to **ALL**, it will
unmask all the paths that are masked by default.
The default masked paths are **/proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux.**
unmask all the paths that are masked or made read only by default.
The default masked paths are **/proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux.**. The default paths that are read only are **/proc/asound**, **/proc/bus**, **/proc/fs**, **/proc/irq**, **/proc/sys**, **/proc/sysrq-trigger**.
Note: Labeling can be disabled for all containers by setting **label=false** in the **containers.conf**(5) file.