Paweł Gronowski
9e6a3c6ea2
Add a SELinux CIL module that denies AF_ALG socket creation for all container domains. Like AppArmor, SELinux hooks into the kernel's security_socket_create() LSM callback, blocking AF_ALG regardless of whether the socket was created via socket(2) or socketcall(2), without disrupting other socketcall usage by 32-bit binaries. This is shipped as a standalone CIL file for packaging repos to install via semodule. It is not loaded by moby itself. Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The contrib directory contains scripts, images, and other helpful things
which are not part of the core docker distribution. Please note that they
could be out of date, since they do not receive the same attention as the
rest of the repository.