9f8e7b5fed
By using the 'unconfined' policy for privileged containers, we have inherited the host's apparmor policies, which really make no sense in the context of the container's filesystem. For instance, policies written against the paths of binaries such as '/usr/sbin/tcpdump' can be easily circumvented by moving the binary within the container filesystem. Fixes GH#5490 Signed-off-by: Eric Windisch <eric@windisch.us> Upstream-commit: 87376c3add7dcd48830060652554e7ae43d11881 Component: engine
38 lines
766 B
Plaintext
38 lines
766 B
Plaintext
#include <tunables/global>
|
|
|
|
profile docker-default flags=(attach_disconnected,mediate_deleted) {
|
|
#include <abstractions/base>
|
|
|
|
network,
|
|
capability,
|
|
file,
|
|
umount,
|
|
|
|
deny @{PROC}/sys/fs/** wklx,
|
|
deny @{PROC}/sysrq-trigger rwklx,
|
|
deny @{PROC}/sys/kernel/[^s][^h][^m]* wklx,
|
|
deny @{PROC}/sys/kernel/*/** wklx,
|
|
|
|
deny mount,
|
|
|
|
deny /sys/[^f]*/** wklx,
|
|
deny /sys/f[^s]*/** wklx,
|
|
deny /sys/fs/[^c]*/** wklx,
|
|
deny /sys/fs/c[^g]*/** wklx,
|
|
deny /sys/fs/cg[^r]*/** wklx,
|
|
deny /sys/firmware/efi/efivars/** rwklx,
|
|
deny /sys/kernel/security/** rwklx,
|
|
}
|
|
|
|
profile docker-unconfined flags=(attach_disconnected,mediate_deleted) {
|
|
#include <abstractions/base>
|
|
|
|
network,
|
|
capability,
|
|
file,
|
|
umount,
|
|
mount,
|
|
pivot_root,
|
|
change_profile -> *,
|
|
}
|