docs: document seccomp usage #3033
Conversation
|
/cc @alban for an overall pass on it. This closely follows the capabilities guide. The |
| The default set is tailored to stop applications from performing a large | ||
| variety of privileged actions, while not impacting their normal behavior. | ||
| Operations which are typically not needed in containers and which may | ||
| impact host state, eg. invoking `umount(2)`, are denied in this way. |
There was a problem hiding this comment.
How does umount() impact the host?
mount() might be a better example.
There was a problem hiding this comment.
By unmounting all the inaccessible procfs/sysfs. But yes, also mount()ing would fit here. Do you have any specific case you would like to see here?
There was a problem hiding this comment.
Ah right. I didn't have a specific case. But instead of using /dev/console as an example, it could use something more dangerous. Maybe /proc/bus?
|
This is excellent! |
Documentation/seccomp-guide.md
Outdated
| ``` | ||
|
|
||
| Once run, it can be easily verified that both `ping` and `umount` from inside | ||
| the container are now functional. These operations also requires additional |
This commit introduces a walk-through guide for seccomp usage. It is targeted to users, introducing them to Linux seccomp in general, documenting the differences between the two available isolators, and how to use them when building images, patching images and running them.
15d4e91 to
bfe063e
Compare
| returning a specific error code ("errno") to the application instead of | ||
| terminating it. | ||
|
|
||
| For both isolators, this can be customized by specifying an additional `errno` |
There was a problem hiding this comment.
An example of how to specify the errno parameter would be helpful.
There was a problem hiding this comment.
Right! I've slightly adapted the existing examples to also show errno in 1bdf84d without adding too much detour, is it clear enough?
`errno` parameter was only mentioned but never shown in practice. This adds some usages into existing examples.
|
@joshix ping. Do you want to have a pass on this or may I go on and perhaps revisit this later? |
|
@jonboulle ack. Just giving a chance to @euank to have a look at the |
|
Thanks, exactly the sorta example I wanted. LGTM |
This commit introduces a walk-through guide for seccomp usage.
It is targeted to users, introducing them to Linux seccomp in
general, documenting the differences between the two available
isolators, and how to use them when building images, patching
images and running them.