Tycho Andersen
70ad19f2e6
These files don't exist under proc so this rule does nothing. They are protected against by docker's default cgroup devices since they're both character devices and not explicitly allowed. Signed-off-by: Tycho Andersen <tycho@docker.com> Upstream-commit: b4a6ccbc5fe695062111cad5a20bb3d0ac5a94db Component: engine
45 lines
1.2 KiB
Go
45 lines
1.2 KiB
Go
// +build linux
|
|
|
|
package apparmor
|
|
|
|
// baseTemplate defines the default apparmor profile for containers.
|
|
const baseTemplate = `
|
|
{{range $value := .Imports}}
|
|
{{$value}}
|
|
{{end}}
|
|
|
|
profile {{.Name}} flags=(attach_disconnected,mediate_deleted) {
|
|
{{range $value := .InnerImports}}
|
|
{{$value}}
|
|
{{end}}
|
|
|
|
network,
|
|
capability,
|
|
file,
|
|
umount,
|
|
|
|
deny @{PROC}/* w, # deny write for all files directly in /proc (not in a subdir)
|
|
# deny write to files not in /proc/<number>/** or /proc/sys/**
|
|
deny @{PROC}/{[^1-9],[^1-9][^0-9],[^1-9s][^0-9y][^0-9s],[^1-9][^0-9][^0-9][^0-9]*}/** w,
|
|
deny @{PROC}/sys/[^k]** w, # deny /proc/sys except /proc/sys/k* (effectively /proc/sys/kernel)
|
|
deny @{PROC}/sys/kernel/{?,??,[^s][^h][^m]**} w, # deny everything except shm* in /proc/sys/kernel/
|
|
deny @{PROC}/sysrq-trigger rwklx,
|
|
deny @{PROC}/kcore rwklx,
|
|
|
|
deny mount,
|
|
|
|
deny /sys/[^f]*/** wklx,
|
|
deny /sys/f[^s]*/** wklx,
|
|
deny /sys/fs/[^c]*/** wklx,
|
|
deny /sys/fs/c[^g]*/** wklx,
|
|
deny /sys/fs/cg[^r]*/** wklx,
|
|
deny /sys/firmware/** rwklx,
|
|
deny /sys/kernel/security/** rwklx,
|
|
|
|
{{if ge .Version 208095}}
|
|
# suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
|
|
ptrace (trace,read) peer={{.Name}},
|
|
{{end}}
|
|
}
|
|
`
|