1. docker
  2. Commit 8b1772c86b20d06ae6bd8ccf4b20f6df4cd86b62
Browse code

oci/defaults_linux.go: mask /sys/firmware

On typical x86_64 machines, /sys/firmware can contain SMBIOS and ACPI tables.
There is no need to expose the directory to containers.

Signed-off-by: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>

Akihiro Suda authored on 2016/10/12 15:07:13
Showing 1 changed files
oci/defaults_linux.go
History View file @ 8b1772c
... ... 
@@ -83,6 +83,7 @@ func DefaultSpec() specs.Spec {
83 83 
 			"/proc/timer_list",
84 84 
 			"/proc/timer_stats",
85 85 
 			"/proc/sched_debug",
86 
+			"/sys/firmware",
86 87 
 		},
87 88 
 		ReadonlyPaths: []string{
88 89 
 			"/proc/asound",