#include <tunables/global>

profile Docker-dsm flags=(attach_disconnected,mediate_deleted) {

  network,
  capability,
  file,
  umount,

  deny umount /proc/**,

  # for RD develope
  mount fstype=nfs,

  # for vfs remote connection
  mount fstype=fuse.gvfsd-fuse,
  mount fstype=fuse,

  # for mount ecryption share
  mount fstype=ecryptfs,
  # for umount ecryption share
  mount options=(rw, noexec, remount, bind) -> /volume*/**,

  # for cifs remote mount
  mount fstype=cifs,

  # for iso mount
  mount fstype=udf,
  mount fstype=iso9660,

  # should not able to mount
  deny mount fstype=debugfs,
  deny mount fstype=devpts,
  deny mount fstype=devtmpfs,
  deny mount fstype=cgroup,
  deny mount fstype=sys,
  deny mount fstype=proc,

  # deny access some proc path
  deny @{PROC}/{*,**^[0-9*],sys/kernel/shm*} wkx,
  deny @{PROC}/sysrq-trigger rwklx,
  deny @{PROC}/mem rwklx,
  deny @{PROC}/kmem rwklx,
  deny @{PROC}/kcore rwklx,

  # deny access some sys path
  deny /sys/[^f]*/** wklx,
  deny /sys/f[^s]*/** wklx,
  deny /sys/fs/[^c]*/** wklx,
  deny /sys/fs/c[^g]*/** wklx,
  deny /sys/fs/cg[^r]*/** wklx,
  deny /sys/firmware/efi/efivars/** rwklx,
  deny /sys/kernel/security/** rwklx,
}
