mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-11-15 07:54:17 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Cleanup profiles according to standards

Browse Source
This commit is contained in:
Jeroen Rijken 2022-07-09 20:33:47 +02:00 committed by Alex
parent c9b4423e45
commit 59f8b893ff
3 changed files with 47 additions and 49 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

74
apparmor.d/groups/virt/containerd
View File

@ -17,61 +17,57 @@ profile containerd @{exec_path} {
capability sys_admin,
capability chown,
mount fstype=tmpfs options in (rw, nosuid, nodev, noexec) -> @{run}/containerd/io.containerd.grpc.v1.cri/sandboxes/[0-9a-f]*/shm/,
mount fstype=zfs -> /var/lib/containerd/tmpmounts/containerd-mount[0-9]*/,
umount /var/lib/containerd/tmpmounts/containerd-mount[0-9]*/,
signal (receive) set=term peer=dockerd,
@{exec_path} mr,
@{exec_path} rm,
/{usr/,}bin/unpigz rPUx,
/{usr/,}{local/,}{s,}bin/zfs rPx,
/{usr/,}bin/containerd-shim-runc-v2 rPUx,
/{usr/,}bin/kmod rPx,
/etc/cni/ rw,
/etc/cni/{,**} r,
/etc/cni/net.d/ rw,
/etc/cni/ rw,
/etc/cni/{,**} r,
/etc/cni/net.d/ rw,
/etc/containerd/*.toml r,
/var/lib/containerd/{,**} rwk,
/var/lib/containerd/tmpmounts/containerd-mount[0-9]*/lib{64,}/** l,
/var/lib/docker/containerd/{,**} rwk,
@{run}/containerd/{,**} rwk,
@{run}/docker/containerd/{,**} rwk,
/opt/containerd/{,**} rw,
mount fstype=tmpfs options in (rw, nosuid, nodev, noexec) -> @{run}/containerd/io.containerd.grpc.v1.cri/sandboxes/[0-9a-f]*/shm/,
@{run}/systemd/notify w,
@{run}/systemd/notify w,
@{run}/containerd/{,**} rwk,
@{run}/docker/containerd/{,**} rwk,
@{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r,
owner @{PROC}/@{pids}/uid_map r,
owner @{PROC}/@{pids}/mountinfo r,
owner @{PROC}/@{pids}/uid_map r,
owner @{PROC}/@{pids}/mountinfo r,
@{PROC}/sys/net/core/somaxconn r,
# Extracting container images
/usr/{local/,}bin/unpigz PUx,
# zfs snapshotter
/{usr/,}{local/,}{s,}bin/zfs Px,
mount fstype=zfs -> /var/lib/containerd/tmpmounts/containerd-mount[0-9]*/,
umount -> /var/lib/containerd/tmpmounts/containerd-mount[0-9]*/,
/var/lib/containerd/tmpmounts/containerd-mount[0-9]*/lib{64,}/** l,
deny /dev/bsg/ r,
deny /dev/bus/ r,
deny /dev/bus/usb/ r,
deny /dev/bus/usb/001/ r,
deny /dev/bus/usb/002/ r,
deny /dev/char/ r,
deny /dev/cpu/ r,
deny /dev/cpu/0/ r,
deny /dev/cpu/1/ r,
deny /dev/dma_heap/ r,
deny /dev/dri/ r,
deny /dev/dri/by-path/ r,
deny /dev/hugepages/ r,
deny /dev/input/ r,
deny /dev/input/by-id/ r,
deny /dev/input/by-path/ r,
deny /dev/net/ r,
deny /dev/snd/ r,
deny /dev/snd/by-path/ r,
deny /dev/vfio/ r,
deny /dev/bsg/ r,
deny /dev/bus/ r,
deny /dev/bus/usb/ r,
deny /dev/bus/usb/[0-9]*/ r,
deny /dev/char/ r,
deny /dev/cpu/ r,
deny /dev/cpu/[0-9]*/ r,
deny /dev/dma_heap/ r,
deny /dev/dri/ r,
deny /dev/dri/by-path/ r,
deny /dev/hugepages/ r,
deny /dev/input/ r,
deny /dev/input/by-id/ r,
deny /dev/input/by-path/ r,
deny /dev/net/ r,
deny /dev/snd/ r,
deny /dev/snd/by-path/ r,
deny /dev/vfio/ r,
include if exists <local/containerd>
}

3
apparmor.d/profiles-s-z/zfs
View File

@ -10,8 +10,9 @@ profile zfs @{exec_path} flags=(complain) {
@{exec_path} r,
/dev/zfs rw,
@{PROC}/@{pids}/mounts r,
/dev/zfs rw,
include if exists <local/zfs>
}

19
apparmor.d/profiles-s-z/zpool
View File

@ -11,18 +11,19 @@ profile zpool @{exec_path} flags=(complain) {
@{exec_path} rm,
/{usr/,}{local/,}lib/zfs-linux/zpool.d/* rix,
/{usr/,}{local/,}bin/{ba,da,k,z,}sh rix,
/dev/zfs rw,
/{usr/,}bin/{,ba,da}sh rix,
/etc/hostid r,
@{run}/blkid/blkid.tab rw,
@{run}/blkid/blkid.tab.old l,
@{run}/blkid/blkid.tab-* rwl,
@{PROC}/sys/kernel/spl/hostid r,
@{PROC}/@{pids}/mounts r,
/dev/zfs rw,
/dev/pts/[0-9]* rw,
/etc/hostid r,
@{PROC}/sys/kernel/spl/hostid r,
/run/blkid/blkid.tab wr,
/run/blkid/blkid.tab.old l,
/run/blkid/blkid.tab-* wrl,
include if exists <local/zfs>
}