diff --git a/contrib/apparmor/template.go b/contrib/apparmor/template.go index ccf4a263d..63e50d299 100644 --- a/contrib/apparmor/template.go +++ b/contrib/apparmor/template.go @@ -53,14 +53,12 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) { capability, file, umount, -{{if ge .Version 208096}} # Host (privileged) processes may send signals to container processes. signal (receive) peer=unconfined, # Manager may send signals to container processes. signal (receive) peer={{.DaemonProfile}}, # Container processes may send signals amongst themselves. signal (send,receive) peer={{.Name}}, -{{end}} deny @{PROC}/* w, # deny write for all files directly in /proc (not in a subdir) # deny write to files not in /proc//** or /proc/sys/** @@ -82,11 +80,9 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) { deny /sys/firmware/** rwklx, deny /sys/kernel/security/** rwklx, -{{if ge .Version 208095}} # allow processes within the container to trace each other, # provided all other LSM and yama setting allow it. ptrace (trace,tracedby,read,readby) peer={{.Name}}, -{{end}} } `