Git-Mirrors/mat2-web
1
0
Fork 0
mirror of https://0xacab.org/jvoisin/mat2-web.git synced 2025-05-11 10:45:20 -04:00
Code Issues Projects Releases Packages Wiki Activity

generated a seccomp profile

Browse source
This commit is contained in:
Jan Friedli 2020-04-12 15:44:53 +02:00
parent 4122460dfd
commit f3019b3b32
No known key found for this signature in database
GPG key ID: F945FA2FCA30549D
2 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
README.md
View file

@ -202,7 +202,7 @@ This does mount the upload folder as tmpfs and servers the app on `localhost:818
##### Podman
Build: `podman build -f Dockerfile.production -t matweb-podman .`
Run: `podman run -ti -p8181:8080 --read-only --tmpfs /tmp --tmpfs /run/uwsgi --tmpfs=/app/upload --security-opt=no-new-privileges matweb-podman:latest`
Run: `podman run -ti -p8181:8080 --read-only --tmpfs /tmp --tmpfs /run/uwsgi --tmpfs=/app/upload --security-opt=no-new-privileges,seccomp=./config/seccomp.json matweb-podman:latest`
# Configuration

1
config/seccomp.json Normal file
View file

@ -0,0 +1 @@
{"defaultAction":"SCMP_ACT_ERRNO","syscalls":[{"names":["accept4","access","arch_prctl","bind","brk","capget","capset","chdir","chmod","clone","close","connect","dup","dup2","epoll_create","epoll_ctl","epoll_pwait","epoll_wait","eventfd2","execve","exit_group","fchown","fcntl","fstat","fstatfs","futex","getcwd","getdents64","getegid","geteuid","getgid","getpid","getppid","getrandom","getsockname","getsockopt","gettid","getuid","ioctl","kill","listen","lseek","lstat","mkdir","mmap","mprotect","mremap","munmap","nanosleep","newfstatat","openat","pipe2","poll","prctl","pread64","prlimit64","pwrite64","read","readlink","readv","recvfrom","recvmsg","rename","rmdir","rt_sigaction","rt_sigprocmask","rt_sigreturn","rt_sigsuspend","seccomp","sendfile","sendmsg","set_robust_list","set_tid_address","setgid","setgroups","setsid","setsockopt","setuid","sigaltstack","socket","socketpair","stat","statfs","sysinfo","tgkill","umask","uname","unlink","unlinkat","wait4","write","writev"],"action":"SCMP_ACT_ALLOW","args":[],"comment":"","includes":{},"excludes":{}},{"names":["ftruncate","pwritev","sched_yield"],"action":"SCMP_ACT_ALLOW","args":[],"comment":"","includes":{},"excludes":{}}]}