Juan Hoyos e224f77eb7 Add process_vm read and write calls to default seccomp profile ...

Follow up to 94faa70df4. The commit referenced allowed `ptrace` calls in the default seccomp profile following the usual tracing security checks in for Kernels newer than 4.8. Kernels prior to this version are susceptible to [CVE-2019-2054](https://github.com/advisories/GHSA-qgfr-27qf-f323).  Moby's default had allowed for `ptrace` for kernels newer than 4.8 at the time the commit was created. The current [seccomp default](https://github.com/moby/moby/blob/master/profiles/seccomp/default_linux.go#L405-L417) has been updated to include `process_vm_read` and `process_vm_write`. Mirror that policy to complete the classic ptrace set of APIs.

Signed-off-by: Juan Hoyos <juan.s.hoyos@outlook.com>

2022-11-18 10:51:45 -05:00

..

kernelversion

allow ptrace(2) by default for kernel >= 4.8

2022-04-18 20:45:29 +00:00

seccomp_default_unsupported.go

Run go fmt with Go 1.17

2021-08-22 09:31:50 +09:00

seccomp_default.go

Add process_vm read and write calls to default seccomp profile

2022-11-18 10:51:45 -05:00

seccomp.go

refactor: move from io/ioutil to io and os package

2021-09-21 09:50:38 +08:00