mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 17:08:09 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(profiles): containerd support for docker & cosmetic.

Browse source
This commit is contained in:
Alexandre Pujol 2022-07-21 20:15:02 +01:00
parent 55bd85796c
commit 48c023d4bd
Failed to generate hash of commit
2 changed files with 24 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
apparmor.d/groups/virt/containerd
View file

@ -10,10 +10,10 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/containerd @{exec_path} = /{usr/,}bin/containerd
profile containerd @{exec_path} flags=(attach_disconnected) { profile containerd @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/ssl_certs>
include <abstractions/nameservice-strict>
include <abstractions/disks-read>
include <abstractions/devices-usb> include <abstractions/devices-usb>
include <abstractions/disks-read>
include <abstractions/nameservice-strict>
include <abstractions/ssl_certs>
capability chown, capability chown,
capability dac_read_search, capability dac_read_search,
@ -47,6 +47,11 @@ profile containerd @{exec_path} flags=(attach_disconnected) {
/{usr/,}bin/unpigz rPUx, /{usr/,}bin/unpigz rPUx,
/{usr/,}{local/,}{s,}bin/zfs rPx, /{usr/,}{local/,}{s,}bin/zfs rPx,
/opt/cni/bin/loopback rPx,
/opt/cni/bin/portmap rPx,
/opt/cni/bin/bandwidth rPx,
/opt/cni/bin/calico rPx,
/ r, / r,
/etc/cni/ rw, /etc/cni/ rw,
@ -54,11 +59,6 @@ profile containerd @{exec_path} flags=(attach_disconnected) {
/etc/cni/net.d/ rw, /etc/cni/net.d/ rw,
/etc/containerd/*.toml r, /etc/containerd/*.toml r,
/opt/cni/bin/loopback rPx,
/opt/cni/bin/portmap rPx,
/opt/cni/bin/bandwidth rPx,
/opt/cni/bin/calico rPx,
/opt/containerd/{,**} rw, /opt/containerd/{,**} rw,
/var/lib/cni/{,**/} w, /var/lib/cni/{,**/} w,

18
apparmor.d/groups/virt/containerd-shim-runc-v2
View file

@ -1,4 +1,5 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
# Copyright (C) 2022 Jeroen Rijken # Copyright (C) 2022 Jeroen Rijken
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
@ -9,9 +10,10 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/containerd-shim-runc-v2 @{exec_path} = /{usr/,}bin/containerd-shim-runc-v2
profile containerd-shim-runc-v2 @{exec_path} flags=(complain,attach_disconnected) { profile containerd-shim-runc-v2 @{exec_path} flags=(complain,attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles>
capability dac_read_search,
capability dac_override, capability dac_override,
capability dac_read_search,
capability net_admin, capability net_admin,
capability sys_admin, capability sys_admin,
capability sys_resource, capability sys_resource,
@ -20,20 +22,28 @@ profile containerd-shim-runc-v2 @{exec_path} flags=(complain,attach_disconnected
umount /run/containerd/io.containerd.runtime.v2.task/k8s.io/[0-9a-z]*/rootfs/, umount /run/containerd/io.containerd.runtime.v2.task/k8s.io/[0-9a-z]*/rootfs/,
@{exec_path} mrix, @{exec_path} mrix,
/{usr/,}{s,}bin/runc rPUx, /{usr/,}{s,}bin/runc rPUx,
/tmp/runc-process[0-9]* rw, /tmp/runc-process[0-9]* rw,
/tmp/pty[0-9]*/ rw,
/tmp/pty[0-9]*/pty.sock rw,
@{run}/containerd/ rw,
@{run}/containerd/containerd.sock.ttrpc rw, @{run}/containerd/containerd.sock.ttrpc rw,
@{run}/containerd/io.containerd.grpc.v1.cri/containers/[0-9a-z]*/io/[0-9]*/[0-9a-z]*-stderr rw, @{run}/containerd/io.containerd.grpc.v1.cri/containers/[0-9a-z]*/io/[0-9]*/[0-9a-z]*-stderr rw,
@{run}/containerd/io.containerd.grpc.v1.cri/containers/[0-9a-z]*/io/[0-9]*/[0-9a-z]*-stdout rw, @{run}/containerd/io.containerd.grpc.v1.cri/containers/[0-9a-z]*/io/[0-9]*/[0-9a-z]*-stdout rw,
@{run}/containerd/io.containerd.runtime.v2.task/k8s.io/[0-9a-z]*/{,*} rw, @{run}/containerd/io.containerd.runtime.v2.task/k8s.io/[0-9a-z]*/{,*} rw,
@{run}/containerd/s/[0-9a-z]* rw, @{run}/containerd/s/{,[0-9a-z]*} rw,
@{run}/docker/containerd/[0-9a-f]*/[0-9a-f]*-{stdin,stdout,stderr} rw,
@{run}/docker/containerd/[0-9a-f]*/init-{stdin,stdout,stderr} rw,
@{run}/docker/containerd/daemon/io.containerd.*/{,**} rw,
@{run}/secrets/kubernetes.io/serviceaccount/*/token w, @{run}/secrets/kubernetes.io/serviceaccount/*/token w,
@{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r,
@{sys}/fs/cgroup/kubepods/{,**} rw,
@{sys}/fs/cgroup/{,**} rw, @{sys}/fs/cgroup/{,**} rw,
@{sys}/fs/cgroup/kubepods/{,**} rw,
@{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r,
@{PROC}/@{pids}/cgroup r, @{PROC}/@{pids}/cgroup r,
@{PROC}/@{pids}/oom_score_adj rw, @{PROC}/@{pids}/oom_score_adj rw,