github/containerd
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity

Merge pull request #10123 from woky/apparmor-runc

Browse Source 
apparmor: Allow confined runc to kill containers
This commit is contained in:
Samuel Karp 2024-04-24 22:01:12 +00:00 committed by GitHub
commit 01ed3ff123
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
contrib/apparmor/template.go
View File

@ -55,6 +55,10 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) {
umount, umount,
# Host (privileged) processes may send signals to container processes. # Host (privileged) processes may send signals to container processes.
signal (receive) peer=unconfined, signal (receive) peer=unconfined,
# runc may send signals to container processes.
signal (receive) peer=runc,
# crun may send signals to container processes.
signal (receive) peer=crun,
# Manager may send signals to container processes. # Manager may send signals to container processes.
signal (receive) peer={{.DaemonProfile}}, signal (receive) peer={{.DaemonProfile}},
# Container processes may send signals amongst themselves. # Container processes may send signals amongst themselves.