mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-11-15 16:03:51 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Various containerd fixes

Browse Source
This commit is contained in:
Jeroen Rijken 2022-07-16 17:34:14 +02:00 committed by Alex
parent c750cb1b77
commit 13aee74df9
1 changed files with 20 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
apparmor.d/groups/virt/containerd
View File

@ -16,6 +16,7 @@ profile containerd @{exec_path} flags=(attach_disconnected) {
capability chown, capability chown,
capability dac_read_search, capability dac_read_search,
capability dac_override,
capability net_admin, capability net_admin,
capability sys_admin, capability sys_admin,
@ -23,11 +24,13 @@ profile containerd @{exec_path} flags=(attach_disconnected) {
network inet6 dgram, network inet6 dgram,
network inet stream, network inet stream,
network inet6 stream, network inet6 stream,
network netlink raw,
mount fstype=tmpfs options in (rw, nosuid, nodev, noexec) -> @{run}/containerd/io.containerd.grpc.v1.cri/sandboxes/[0-9a-f]*/shm/, mount fstype=tmpfs options in (rw, nosuid, nodev, noexec) -> @{run}/containerd/io.containerd.grpc.v1.cri/sandboxes/[0-9a-f]*/shm/,
mount fstype=zfs -> /var/lib/containerd/tmpmounts/containerd-mount[0-9]*/, mount fstype=zfs -> /var/lib/containerd/tmpmounts/containerd-mount[0-9]*/,
mount options in (rw, bind, nosuid, nodev, noexec) -> @{run}/netns/cni-@{uuid}, mount options in (rw, bind, nosuid, nodev, noexec) -> @{run}/netns/cni-@{uuid},
umount @{run}/containerd/io.containerd.grpc.v1.cri/sandboxes/[0-9a-f]*/shm/,
umount /var/lib/containerd/tmpmounts/containerd-mount[0-9]*/, umount /var/lib/containerd/tmpmounts/containerd-mount[0-9]*/,
umount @{run}/netns/cni-@{uuid}, umount @{run}/netns/cni-@{uuid},
@ -72,28 +75,27 @@ profile containerd @{exec_path} flags=(attach_disconnected) {
@{sys}/module/apparmor/parameters/enabled r, @{sys}/module/apparmor/parameters/enabled r,
@{PROC}/@{pid}/task/@{tid}/ns/net rw, @{PROC}/@{pid}/task/@{tid}/ns/net rw,
owner @{PROC}/@{pids}/attr/current r,
owner @{PROC}/@{pids}/uid_map r, owner @{PROC}/@{pids}/uid_map r,
owner @{PROC}/@{pids}/mountinfo r, owner @{PROC}/@{pids}/mountinfo r,
@{PROC}/sys/net/core/somaxconn r, @{PROC}/sys/net/core/somaxconn r,
deny /dev/bsg/ rwkl, /dev/bsg/ r,
deny /dev/bus/ rwkl, /dev/bus/ r,
deny /dev/bus/usb/ rwkl, /dev/char/ r,
deny /dev/bus/usb/[0-9]*/ rwkl, /dev/cpu/ r,
deny /dev/char/ rwkl, /dev/cpu/[0-9]*/ r,
deny /dev/cpu/ rwkl, /dev/dma_heap/ r,
deny /dev/cpu/[0-9]*/ rwkl, /dev/dri/ r,
deny /dev/dma_heap/ rwkl, /dev/dri/by-path/ r,
deny /dev/dri/ rwkl, /dev/hugepages/ r,
deny /dev/dri/by-path/ rwkl, /dev/input/ r,
deny /dev/hugepages/ rwkl, /dev/input/by-id/ r,
deny /dev/input/ rwkl, /dev/input/by-path/ r,
deny /dev/input/by-id/ rwkl, /dev/net/ r,
deny /dev/input/by-path/ rwkl, /dev/snd/ r,
deny /dev/net/ rwkl, /dev/snd/by-path/ r,
deny /dev/snd/ rwkl, /dev/vfio/ r,
deny /dev/snd/by-path/ rwkl,
deny /dev/vfio/ rwkl,
include if exists <local/containerd> include if exists <local/containerd>
} }