docker
/
docs
mirror of https://github.com/docker/docs.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
docs/profiles
History
Justin Cormack 265f7a37bd Gate name_to_handle_at by CAP_SYS_ADMIN not CAP_DAC_READ_SEARCH 
Only open_by_handle_at requires CAP_DAC_READ_SEARCH.

This allows systemd to run with only `--cap-add SYS_ADMIN`
rather than having to also add `--cap-add DAC_READ_SEARCH`
as well which it does not really need.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
(cherry picked from commit c1ca124682a90f3306b34ad104ba80e413f7bf88)
Signed-off-by: Tibor Vass <tibor@docker.com>
 		2016-08-11 17:56:50 -07:00
..
apparmor profiles: apparmor: actually calculate version 2016-03-20 19:03:19 +11:00
seccomp Gate name_to_handle_at by CAP_SYS_ADMIN not CAP_DAC_READ_SEARCH 2016-08-11 17:56:50 -07:00