diff --git a/content/engine/security/seccomp.md b/content/engine/security/seccomp.md index 5be2672d11..1ea65a0b9d 100644 --- a/content/engine/security/seccomp.md +++ b/content/engine/security/seccomp.md @@ -26,7 +26,7 @@ protective while providing wide application compatibility. The default Docker profile can be found [here](https://github.com/moby/moby/blob/master/profiles/seccomp/default.json). -In effect, the profile is a allowlist which denies access to system calls by +In effect, the profile is an allowlist which denies access to system calls by default, then allowlists specific system calls. The profile works by defining a `defaultAction` of `SCMP_ACT_ERRNO` and overriding that action only for specific system calls. The effect of `SCMP_ACT_ERRNO` is to cause a `Permission Denied` @@ -117,4 +117,4 @@ profile. ```console $ docker run --rm -it --security-opt seccomp=unconfined debian:jessie \ unshare --map-root-user --user sh -c whoami -``` \ No newline at end of file +```