From 74c22d04d745ac37e0616fdbbcee5bf0a4e00294 Mon Sep 17 00:00:00 2001 From: Colin Walters Date: Thu, 12 Apr 2018 17:38:59 -0400 Subject: [PATCH] security-context: Tweak seccomp description (#8024) It's not just about files; seccomp allows filtering any system call. --- docs/tasks/configure-pod-container/security-context.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/tasks/configure-pod-container/security-context.md b/docs/tasks/configure-pod-container/security-context.md index 92f32f24a1..88d58ce305 100644 --- a/docs/tasks/configure-pod-container/security-context.md +++ b/docs/tasks/configure-pod-container/security-context.md @@ -22,7 +22,7 @@ a Pod or Container. Security context settings include: * [AppArmor](/docs/tutorials/clusters/apparmor/): Use program profiles to restrict the capabilities of individual programs. -* [Seccomp](https://en.wikipedia.org/wiki/Seccomp): Limit a process's access to open file descriptors. +* [Seccomp](https://en.wikipedia.org/wiki/Seccomp): Filter a process's system calls. * AllowPrivilegeEscalation: Controls whether a process can gain more privileges than its parent process. This bool directly controls whether the [`no_new_privs`](https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt) flag gets set on the container process. AllowPrivilegeEscalation is true always when the container is: 1) run as Privileged OR 2) has `CAP_SYS_ADMIN`.