github/containerd
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity

Merge pull request #7714 from hoyosjs/patch-1

Browse Source 
Add ptrace readby and tracedby to default AppArmor profile
This commit is contained in:
Fu Wei 2022-11-28 22:32:59 +08:00 committed by GitHub
commit 4b8002e5d1
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
contrib/apparmor/template.go
View File

@ -84,7 +84,9 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) {
deny /sys/kernel/security/** rwklx, deny /sys/kernel/security/** rwklx,
{{if ge .Version 208095}} {{if ge .Version 208095}}
ptrace (trace,read) peer={{.Name}}, # allow processes within the container to trace each other,
# provided all other LSM and yama setting allow it.
ptrace (trace,tracedby,read,readby) peer={{.Name}},
{{end}} {{end}}
} }
` `