0ct0pu5/moby
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge pull request #44960 from thaJeztah/aaparser_remove_version

Browse source 
profiles/apparmor, contrib/apparmor: remove version-conditionals from template
This commit is contained in:
Sebastiaan van Stijn 2023-02-08 22:19:58 +01:00 • committed by GitHub
commit 2b654b37f1
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 0 additions and 18 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
contrib/apparmor/template.go
View file

@ -20,11 +20,9 @@ profile /usr/bin/docker (attach_disconnected, complain) {
umount,
pivot_root,
{{if ge .Version 209000}}
signal (receive) peer=@{profile_name},
signal (receive) peer=unconfined,
signal (send),
{{end}}
network,
capability,
owner /** rw,
@ -47,12 +45,10 @@ profile /usr/bin/docker (attach_disconnected, complain) {
/etc/ld.so.cache r,
/etc/passwd r,
{{if ge .Version 209000}}
ptrace peer=@{profile_name},
ptrace (read) peer=docker-default,
deny ptrace (trace) peer=docker-default,
deny ptrace peer=/usr/bin/docker///bin/ps,
{{end}}
/usr/lib/** rm,
/lib/** rm,
@ -73,11 +69,9 @@ profile /usr/bin/docker (attach_disconnected, complain) {
/sbin/zfs rCx,
/sbin/apparmor_parser rCx,
{{if ge .Version 209000}}
# Transitions
change_profile -> docker-*,
change_profile -> unconfined,
{{end}}
profile /bin/cat (complain) {
/etc/ld.so.cache r,
@ -99,10 +93,8 @@ profile /usr/bin/docker (attach_disconnected, complain) {
/dev/null rw,
/bin/ps mr,
{{if ge .Version 209000}}
# We don't need ptrace so we'll deny and ignore the error.
deny ptrace (read, trace),
{{end}}
# Quiet dac_override denials
deny capability dac_override,
@ -120,15 +112,11 @@ profile /usr/bin/docker (attach_disconnected, complain) {
/proc/tty/drivers r,
}
profile /sbin/iptables (complain) {
{{if ge .Version 209000}}
signal (receive) peer=/usr/bin/docker,
{{end}}
capability net_admin,
}
profile /sbin/auplink flags=(attach_disconnected, complain) {
{{if ge .Version 209000}}
signal (receive) peer=/usr/bin/docker,
{{end}}
capability sys_admin,
capability dac_override,
@ -147,9 +135,7 @@ profile /usr/bin/docker (attach_disconnected, complain) {
/proc/[0-9]*/mounts rw,
}
profile /sbin/modprobe /bin/kmod (complain) {
{{if ge .Version 209000}}
signal (receive) peer=/usr/bin/docker,
{{end}}
capability sys_module,
/etc/ld.so.cache r,
/lib/** rm,

4
profiles/apparmor/template.go
View file

@ -24,14 +24,12 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) {
capability,
file,
umount,
{{if ge .Version 208096}}
# Host (privileged) processes may send signals to container processes.
signal (receive) peer=unconfined,
# dockerd may send signals to container processes (for "docker kill").
signal (receive) peer={{.DaemonProfile}},
# Container processes may send signals amongst themselves.
signal (send,receive) peer={{.Name}},
{{end}}
deny @{PROC}/* w, # deny write for all files directly in /proc (not in a subdir)
# deny write to files not in /proc/<number>/** or /proc/sys/**
@ -51,9 +49,7 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) {
deny /sys/firmware/** rwklx,
deny /sys/kernel/security/** rwklx,
{{if ge .Version 208095}}
# suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
ptrace (trace,read,tracedby,readby) peer={{.Name}},
{{end}}
}
`