Juan Hoyos 8d868dadb7 Add ptrace readby and tracedby to default AppArmor profile ... Fixes https://github.com/containerd/containerd/issues/7695. The default profile allows processes within the container to trace others, but blocks reads/traces. This means that diagnostic facilities in processes can't easily collect crash/hang dumps. A usual workflow used by solutions like crashpad and similar projects is that the process that's unresponsive will spawn a process to collect diagnostic data using ptrace. seccomp-bpf, yama ptrace settings, and CAP_SYS_PTRACE already provide security mechanisms to reduce the scopes in which the API can be used. This enables reading from /proc/* files provided the tracer process passes all other checks. Signed-off-by: Juan Hoyos <juan.s.hoyos@outlook.com>		2022-11-23 15:01:32 -05:00
..
apparmor_fuzzer.go	Copy fuzzers from github.com/cncf/cncf-fuzzing	2022-07-06 15:21:48 +00:00
apparmor_test.go	Run go fmt with Go 1.17	2021-08-22 09:31:50 +09:00
apparmor_unsupported.go	feat: replace github.com/pkg/errors to errors	2022-01-07 10:27:03 +08:00
apparmor.go	feat: replace github.com/pkg/errors to errors	2022-01-07 10:27:03 +08:00
template_test.go	Use testify	2022-04-01 18:17:58 -07:00
template.go	Add ptrace readby and tracedby to default AppArmor profile	2022-11-23 15:01:32 -05:00