github/containerd
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity

Merge pull request #8068 from thaJeztah/apparmor_remove_versioned

Browse Source 
contrib/apparmor: remove version-dependent rules
This commit is contained in:
Phil Estes 2023-02-13 11:30:20 -05:00 committed by GitHub
commit ee73e2e9fe
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 0 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
contrib/apparmor/template.go
View File

@ -53,14 +53,12 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) {
capability, capability,
file, file,
umount, umount,
{{if ge .Version 208096}}
# Host (privileged) processes may send signals to container processes. # Host (privileged) processes may send signals to container processes.
signal (receive) peer=unconfined, signal (receive) peer=unconfined,
# Manager may send signals to container processes. # Manager may send signals to container processes.
signal (receive) peer={{.DaemonProfile}}, signal (receive) peer={{.DaemonProfile}},
# Container processes may send signals amongst themselves. # Container processes may send signals amongst themselves.
signal (send,receive) peer={{.Name}}, signal (send,receive) peer={{.Name}},
{{end}}
deny @{PROC}/* w, # deny write for all files directly in /proc (not in a subdir) deny @{PROC}/* w, # deny write for all files directly in /proc (not in a subdir)
# deny write to files not in /proc/<number>/** or /proc/sys/** # deny write to files not in /proc/<number>/** or /proc/sys/**
@ -82,11 +80,9 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) {
deny /sys/firmware/** rwklx, deny /sys/firmware/** rwklx,
deny /sys/kernel/security/** rwklx, deny /sys/kernel/security/** rwklx,
{{if ge .Version 208095}}
# allow processes within the container to trace each other, # allow processes within the container to trace each other,
# provided all other LSM and yama setting allow it. # provided all other LSM and yama setting allow it.
ptrace (trace,tracedby,read,readby) peer={{.Name}}, ptrace (trace,tracedby,read,readby) peer={{.Name}},
{{end}}
} }
` `