Merge pull request from GHSA-jq35-85cj-fj4p

[master] deny /sys/devices/virtual/powercap
runpod · Oct 25, 2023 · c9ccbfa · c9ccbfa
2 parents 4776a9e + bddd826
commit c9ccbfa
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 0 deletions.
diff --git a/oci/defaults.go b/oci/defaults.go
@@ -113,6 +113,7 @@ func DefaultLinuxSpec() specs.Spec {
 				"/proc/sched_debug",
 				"/proc/scsi",
 				"/sys/firmware",
+				"/sys/devices/virtual/powercap",
 			},
 			ReadonlyPaths: []string{
 				"/proc/bus",

diff --git a/profiles/apparmor/template.go b/profiles/apparmor/template.go
@@ -46,6 +46,7 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) {
   deny /sys/fs/c[^g]*/** wklx,
   deny /sys/fs/cg[^r]*/** wklx,
   deny /sys/firmware/** rwklx,
+  deny /sys/devices/virtual/powercap/** rwklx,
   deny /sys/kernel/security/** rwklx,
 
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container