whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security-context: Tweak seccomp description (#8024)

Browse Source 
It's not just about files; seccomp allows filtering any system call.
This commit is contained in:
Colin Walters
2018-04-12 17:38:59 -04:00
committed by k8s-ci-robot
parent 3a7de9b1d6
commit 74c22d04d7
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/tasks/configure-pod-container/security-context.md
+1 -1
View File
@@ -22,7 +22,7 @@ a Pod or Container. Security context settings include:
* [AppArmor](/docs/tutorials/clusters/apparmor/): Use program profiles to restrict the capabilities of individual programs.
* [Seccomp](https://en.wikipedia.org/wiki/Seccomp): Limit a process's access to open file descriptors.
* [Seccomp](https://en.wikipedia.org/wiki/Seccomp): Filter a process's system calls.
* AllowPrivilegeEscalation: Controls whether a process can gain more privileges than its parent process. This bool directly controls whether the [`no_new_privs`](https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt) flag gets set on the container process. AllowPrivilegeEscalation is true always when the container is: 1) run as Privileged OR 2) has `CAP_SYS_ADMIN`.