oci/defaults_linux.go: mask /sys/firmware

On typical x86_64 machines, /sys/firmware can contain SMBIOS and ACPI tables. There is no need to expose the directory to containers. Signed-off-by: Akihiro Suda <[email protected]>
awhitcroft · Oct 12, 2016 · 8b1772c · 8b1772c
1 parent 9bd8c1d
commit 8b1772c
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/oci/defaults_linux.go b/oci/defaults_linux.go
@@ -83,6 +83,7 @@ func DefaultSpec() specs.Spec {
 			"/proc/timer_list",
 			"/proc/timer_stats",
 			"/proc/sched_debug",
+			"/sys/firmware",
 		},
 		ReadonlyPaths: []string{
 			"/proc/asound",