From 2019ed6eb5b87518501aa873cc62e99c51ac1dc0 Mon Sep 17 00:00:00 2001
From: Stefan Berger <stefanb@us.ibm.com>
Date: Thu, 30 Jul 2015 06:24:41 -0400
Subject: [PATCH] contrib: Extend engine apparmor profile for tools needed by
 devicemapper

Add tools to the apparmor profile that are needed when -s devicemapper is
in the docker daemon's command line.

Signed-off-by: Stefan Berger <stefanb@us.ibm.com>
Upstream-commit: 9dbc36b44146c82804206c1240b94216b69c740e
Component: engine
---
 .../engine/contrib/apparmor/docker-engine     | 59 +++++++++++++++++++
 1 file changed, 59 insertions(+)

diff --git a/components/engine/contrib/apparmor/docker-engine b/components/engine/contrib/apparmor/docker-engine
index bdfc207568..a087aaae0a 100644
--- a/components/engine/contrib/apparmor/docker-engine
+++ b/components/engine/contrib/apparmor/docker-engine
@@ -41,6 +41,9 @@ profile /usr/bin/docker (attach_disconnected, complain) {
   /sbin/iptables rCx,
   /sbin/modprobe rCx,
   /sbin/auplink rCx,
+  /sbin/mke2fs rCx,
+  /sbin/tune2fs rCx,
+  /sbin/blkid rCx,
   /bin/kmod rCx,
   /usr/bin/xz rCx,
   /bin/ps rCx,
@@ -148,4 +151,60 @@ profile /usr/bin/docker (attach_disconnected, complain) {
     file,
     capability,
   }
+  profile /sbin/mke2fs (complain) {
+    /sbin/mke2fs rm,
+
+    /lib/** r,
+
+    /apparmor/.null w,
+
+    /etc/ld.so.cache r,
+    /etc/mke2fs.conf r,
+    /etc/mtab r,
+
+    /dev/dm-* rw,
+    /dev/urandom r,
+    /dev/null rw,
+
+    /proc/swaps r,
+    /proc/[0-9]*/mounts r,
+  }
+  profile /sbin/tune2fs (complain) {
+    /sbin/tune2fs rm,
+
+    /lib/** r,
+
+    /apparmor/.null w,
+
+    /etc/blkid.conf r,
+    /etc/mtab r,
+    /etc/ld.so.cache r,
+
+    /dev/null rw,
+    /dev/.blkid.tab r,
+    /dev/dm-* rw,
+
+    /proc/swaps r,
+    /proc/[0-9]*/mounts r,
+  }
+  profile /sbin/blkid (complain) {
+    /sbin/blkid rm,
+
+    /lib/** r,
+    /apparmor/.null w,
+
+    /etc/ld.so.cache r,
+    /etc/blkid.conf r,
+
+    /dev/null rw,
+    /dev/.blkid.tab rl,
+    /dev/.blkid.tab* rwl,
+    /dev/dm-* r,
+
+    /sys/devices/virtual/block/** r,
+
+    capability mknod,
+
+    mount -> @{DOCKER_GRAPH_PATH}/**,
+  }
 }