From caf82772b761a22c5c22ca30f1efe1974459a173 Mon Sep 17 00:00:00 2001
From: Antonio Murdaca <runcom@redhat.com>
Date: Thu, 5 Jul 2018 17:06:08 +0200
Subject: [PATCH] Add /proc/acpi to masked paths

The deafult OCI linux spec in oci/defaults{_linux}.go in Docker/Moby
from 1.11 to current upstream master does not block /proc/acpi pathnames
allowing attackers to modify host's hardware like enabling/disabling
bluetooth or turning up/down keyboard brightness. SELinux prevents all
of this if enabled.

Signed-off-by: Antonio Murdaca <runcom@redhat.com>
(cherry picked from commit 569b9702a59804617e1cd3611fbbe953e4247b3e)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
---
 oci/defaults.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/oci/defaults.go b/oci/defaults.go
index 4145412dd493b..992157b0f5771 100644
--- a/oci/defaults.go
+++ b/oci/defaults.go
@@ -114,6 +114,7 @@ func DefaultLinuxSpec() specs.Spec {
 
 	s.Linux = &specs.Linux{
 		MaskedPaths: []string{
+			"/proc/acpi",
 			"/proc/kcore",
 			"/proc/keys",
 			"/proc/latency_stats",