[aa-profile] Deny access to /proc/acpi/**

Signed-off-by: Pierre-Elliott Bécue <becue@crans.org>

[aa-profile] Deny access to /proc/acpi/**
556a896e · Pierre-Elliott Bécue · Christian Brauner · 39b5ca92 · 556a896e
Unverified Commit 556a896e authored Aug 10, 2019 by Pierre-Elliott Bécue Committed by Christian Brauner Dec 02, 2019
Hide whitespace changes
Inline Side-by-side

Showing with 1 addition and 0 deletions

container-base.in config/apparmor/abstractions/container-base.in +1 -0

No files found.
--- a/config/apparmor/abstractions/container-base.in
+++ b/config/apparmor/abstractions/container-base.in
@@ -73,6 +73,7 @@
  # block some other dangerous paths
  deny @{PROC}/kcore rwklx,
  deny @{PROC}/sysrq-trigger rwklx,
+  deny @{PROC}/acpi/** rwklx,

  # deny writes in /sys except for /sys/fs/cgroup, also allow
  # fusectl, securityfs and debugfs to be mounted there (read-only)