mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-29 22:35:15 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

First batch of cleanups based on PR comments.

Browse source
This commit is contained in:
Jeroen Rijken 2022-07-19 21:58:27 +02:00 committed by Alex
parent c03c624472
commit a1f4dbee50
2 changed files with 5 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
apparmor.d/groups/virt/cni-calico
View file

@ -36,9 +36,8 @@ profile cni-calico @{exec_path} flags=(attach_disconnected) {
@{run}/calico/ipam.lock rwk,
@{run}/netns/cni-@{uuid} r,
@{PROC}/sys/net/ipv4/ip_forward rw,
@{PROC}/sys/net/ipv4/{conf,neigh}/cali[0-9a-z]*/* rw,
@{PROC}/sys/net/ipv6/{conf,neigh}/cali[0-9a-z]*/* rw,
@{PROC}/sys/net/ipv{4,6}/ip_forward rw,
@{PROC}/sys/net/ipv{4,6}/{conf,neigh}/cali[0-9a-z]*/* rw,
@{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r,

8
apparmor.d/groups/virt/k3s
View file

@ -80,9 +80,7 @@ profile k3s @{exec_path} flags=(complain) {
/var/log/pods/{,**/} rw,
/var/log/pods/**/[0-9]*.log rw,
owner @{HOME}/.kube/cache/discovery/{,**} rw,
owner @{HOME}/.kube/cache/http/[0-9a-z]* rw,
owner @{HOME}/.kube/cache/http/.diskv-temp/[0-9]* rw,
owner @{HOME}/.kube/** rw,
@{run}/containerd/containerd.sock rw,
@{run}/systemd/notify w,
@ -109,8 +107,8 @@ profile k3s @{exec_path} flags=(complain) {
@{PROC}/modules r,
@{PROC}/sys/fs/pipe-max-size r,
@{PROC}/sys/net/core/somaxconn r,
@{PROC}/sys/net/ipv4/conf/all/* rw,
@{PROC}/sys/net/ipv4/conf/default/* rw,
@{PROC}/sys/net/ipv{4,6}/conf/all/* rw,
@{PROC}/sys/net/ipv{4,6}/conf/default/* rw,
@{PROC}/sys/net/bridge/bridge-nf-call-iptables r,
@{PROC}/sys/net/netfilter/* rw,
@{PROC}/sys/kernel/keys/* r,