Guest24897
/
DockerCLI
mirror of https://github.com/docker/cli.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add support for NoNewPrivileges in docker 

Signed-off-by: Mrunal Patel <mrunalp@gmail.com>

Add tests for no-new-privileges

Signed-off-by: Mrunal Patel <mrunalp@gmail.com>

Update documentation for no-new-privileges

Signed-off-by: Mrunal Patel <mrunalp@gmail.com>
This commit is contained in:
Mrunal Patel 2016-02-21 21:31:21 -08:00 committed by Tibor Vass
parent 8f095a76ab
commit d3f632156e
2 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
docs/reference/run.md
View File

@ -605,6 +605,8 @@ with the same logic -- if the original volume was specified with a name it will
--security-opt="label:disable" : Turn off label confinement for the container --security-opt="label:disable" : Turn off label confinement for the container
--security-opt="apparmor:PROFILE" : Set the apparmor profile to be applied --security-opt="apparmor:PROFILE" : Set the apparmor profile to be applied
to the container to the container
--security-opt="no-new-privileges" : Disable container processes from gaining
new privileges
You can override the default labeling scheme for each container by specifying You can override the default labeling scheme for each container by specifying
the `--security-opt` flag. For example, you can specify the MCS/MLS level, a the `--security-opt` flag. For example, you can specify the MCS/MLS level, a
@ -631,6 +633,13 @@ command:
> **Note**: You would have to write policy defining a `svirt_apache_t` type. > **Note**: You would have to write policy defining a `svirt_apache_t` type.
If you want to prevent your container processes from gaining additional
privileges, you can execute the following command:
$ docker run --security-opt no-new-privileges -it centos bash
For more details, see [kernel documentation](https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt).
## Specifying custom cgroups ## Specifying custom cgroups
Using the `--cgroup-parent` flag, you can pass a specific cgroup to run a Using the `--cgroup-parent` flag, you can pass a specific cgroup to run a

2
man/docker-run.1.md
View File

@ -459,6 +459,8 @@ its root filesystem mounted as read only prohibiting any writes.
"label:type:TYPE" : Set the label type for the container "label:type:TYPE" : Set the label type for the container
"label:level:LEVEL" : Set the label level for the container "label:level:LEVEL" : Set the label level for the container
"label:disable" : Turn off label confinement for the container "label:disable" : Turn off label confinement for the container
"no-new-privileges" : Disable container processes from gaining additional privileges
**--stop-signal**=*SIGTERM* **--stop-signal**=*SIGTERM*
Signal to stop a container. Default is SIGTERM. Signal to stop a container. Default is SIGTERM.