From d035738408fe246fa65724a5ee5a2701f879102e Mon Sep 17 00:00:00 2001 From: Almeida de Almeida <39647781+AlmeidaJoao@users.noreply.github.com> Date: Sun, 12 Nov 2023 11:15:29 +0200 Subject: [PATCH] Update seccomp.md --- content/engine/security/seccomp.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/engine/security/seccomp.md b/content/engine/security/seccomp.md index 5be2672d11..1ea65a0b9d 100644 --- a/content/engine/security/seccomp.md +++ b/content/engine/security/seccomp.md @@ -26,7 +26,7 @@ protective while providing wide application compatibility. The default Docker profile can be found [here](https://github.com/moby/moby/blob/master/profiles/seccomp/default.json). -In effect, the profile is a allowlist which denies access to system calls by +In effect, the profile is an allowlist which denies access to system calls by default, then allowlists specific system calls. The profile works by defining a `defaultAction` of `SCMP_ACT_ERRNO` and overriding that action only for specific system calls. The effect of `SCMP_ACT_ERRNO` is to cause a `Permission Denied` @@ -117,4 +117,4 @@ profile. ```console $ docker run --rm -it --security-opt seccomp=unconfined debian:jessie \ unshare --map-root-user --user sh -c whoami -``` \ No newline at end of file +```