diff options
| author | OpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com> | 2021-01-04 14:49:41 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-01-04 14:49:41 +0100 |
| commit | 8e4d19da1547985c5f3aa01eae82db70644d15f1 (patch) | |
| tree | f72af44835e00ceb2c99c1f1c505a6bdbadc818f /pkg | |
| parent | 23f25b8261cf2c0d83f8ce5b8251951a11a7e2c4 (diff) | |
| parent | bd35792b0c1372aacd344e324f04529f16cf0711 (diff) | |
| download | podman-8e4d19da1547985c5f3aa01eae82db70644d15f1.tar.gz podman-8e4d19da1547985c5f3aa01eae82db70644d15f1.tar.bz2 podman-8e4d19da1547985c5f3aa01eae82db70644d15f1.zip | |
Merge pull request #8863 from mgoltzsche/fix_seccomp_when_privileged
Disable seccomp by default when creating a privileged container.
Diffstat (limited to 'pkg')
| -rw-r--r-- | pkg/specgen/generate/security.go | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/pkg/specgen/generate/security.go b/pkg/specgen/generate/security.go index 0c97dc496..d3cbac76e 100644 --- a/pkg/specgen/generate/security.go +++ b/pkg/specgen/generate/security.go @@ -172,7 +172,7 @@ func securityConfigureGenerator(s *specgen.SpecGenerator, g *generate.Generator, // Clear default Seccomp profile from Generator for unconfined containers // and privileged containers which do not specify a seccomp profile. - if s.SeccompProfilePath == "unconfined" || (s.Privileged && (s.SeccompProfilePath == config.SeccompOverridePath || s.SeccompProfilePath == config.SeccompDefaultPath)) { + if s.SeccompProfilePath == "unconfined" || (s.Privileged && (s.SeccompProfilePath == "" || s.SeccompProfilePath == config.SeccompOverridePath || s.SeccompProfilePath == config.SeccompDefaultPath)) { configSpec.Linux.Seccomp = nil } |