summaryrefslogtreecommitdiff
path: root/pkg/specgen
diff options
context:
space:
mode:
authorMax Goltzsche <max.goltzsche@gmail.com>2021-01-02 00:20:10 +0100
committerMax Goltzsche <max.goltzsche@gmail.com>2021-01-02 01:38:19 +0100
commitbd35792b0c1372aacd344e324f04529f16cf0711 (patch)
treea0584a82e356bb15eb915174601c62cdcc57a469 /pkg/specgen
parent39b1cb496766ec3be248f178375d663bc0a14f4a (diff)
downloadpodman-bd35792b0c1372aacd344e324f04529f16cf0711.tar.gz
podman-bd35792b0c1372aacd344e324f04529f16cf0711.tar.bz2
podman-bd35792b0c1372aacd344e324f04529f16cf0711.zip
fix: disable seccomp by default when privileged.
When running a privileged container and `SeccompProfilePath` is empty no seccomp profile should be applied. (Previously this was the case only if `SeccompProfilePath` was set to a non-empty default path.) Closes #8849 Signed-off-by: Max Goltzsche <max.goltzsche@gmail.com>
Diffstat (limited to 'pkg/specgen')
-rw-r--r--pkg/specgen/generate/security.go2
1 files changed, 1 insertions, 1 deletions
diff --git a/pkg/specgen/generate/security.go b/pkg/specgen/generate/security.go
index 0c97dc496..d3cbac76e 100644
--- a/pkg/specgen/generate/security.go
+++ b/pkg/specgen/generate/security.go
@@ -172,7 +172,7 @@ func securityConfigureGenerator(s *specgen.SpecGenerator, g *generate.Generator,
// Clear default Seccomp profile from Generator for unconfined containers
// and privileged containers which do not specify a seccomp profile.
- if s.SeccompProfilePath == "unconfined" || (s.Privileged && (s.SeccompProfilePath == config.SeccompOverridePath || s.SeccompProfilePath == config.SeccompDefaultPath)) {
+ if s.SeccompProfilePath == "unconfined" || (s.Privileged && (s.SeccompProfilePath == "" || s.SeccompProfilePath == config.SeccompOverridePath || s.SeccompProfilePath == config.SeccompDefaultPath)) {
configSpec.Linux.Seccomp = nil
}