template.go 5.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253
  1. package main
  2. const dockerProfileTemplate = `@{DOCKER_GRAPH_PATH}=/var/lib/docker
  3. profile /usr/bin/docker (attach_disconnected, complain) {
  4. # Prevent following links to these files during container setup.
  5. deny /etc/** mkl,
  6. deny /dev/** kl,
  7. deny /sys/** mkl,
  8. deny /proc/** mkl,
  9. mount -> @{DOCKER_GRAPH_PATH}/**,
  10. mount -> /,
  11. mount -> /proc/**,
  12. mount -> /sys/**,
  13. mount -> /run/docker/netns/**,
  14. mount -> /.pivot_root[0-9]*/,
  15. / r,
  16. umount,
  17. pivot_root,
  18. signal (receive) peer=@{profile_name},
  19. signal (receive) peer=unconfined,
  20. signal (send),
  21. network,
  22. capability,
  23. owner /** rw,
  24. @{DOCKER_GRAPH_PATH}/** rwl,
  25. @{DOCKER_GRAPH_PATH}/network/files/boltdb.db k,
  26. @{DOCKER_GRAPH_PATH}/network/files/local-kv.db k,
  27. # For user namespaces:
  28. @{DOCKER_GRAPH_PATH}/[0-9]*.[0-9]*/network/files/boltdb.db k,
  29. @{DOCKER_GRAPH_PATH}/[0-9]*.[0-9]*/network/files/local-kv.db k,
  30. # For non-root client use:
  31. /dev/urandom r,
  32. /dev/null rw,
  33. /dev/pts/[0-9]* rw,
  34. /run/docker.sock rw,
  35. /proc/** r,
  36. /proc/[0-9]*/attr/exec w,
  37. /sys/kernel/mm/hugepages/ r,
  38. /etc/localtime r,
  39. /etc/ld.so.cache r,
  40. /etc/passwd r,
  41. ptrace peer=@{profile_name},
  42. ptrace (read) peer=docker-default,
  43. deny ptrace (trace) peer=docker-default,
  44. deny ptrace peer=/usr/bin/docker///bin/ps,
  45. /usr/lib/** rm,
  46. /lib/** rm,
  47. /usr/bin/docker pix,
  48. /sbin/xtables-multi rCx,
  49. /sbin/iptables rCx,
  50. /sbin/modprobe rCx,
  51. /sbin/auplink rCx,
  52. /sbin/mke2fs rCx,
  53. /sbin/tune2fs rCx,
  54. /sbin/blkid rCx,
  55. /bin/kmod rCx,
  56. /usr/bin/xz rCx,
  57. /bin/ps rCx,
  58. /bin/tar rCx,
  59. /bin/cat rCx,
  60. /sbin/zfs rCx,
  61. /sbin/apparmor_parser rCx,
  62. # Transitions
  63. change_profile -> docker-*,
  64. change_profile -> unconfined,
  65. profile /bin/cat (complain) {
  66. /etc/ld.so.cache r,
  67. /lib/** rm,
  68. /dev/null rw,
  69. /proc r,
  70. /bin/cat mr,
  71. # For reading in 'docker stats':
  72. /proc/[0-9]*/net/dev r,
  73. }
  74. profile /bin/ps (complain) {
  75. /etc/ld.so.cache r,
  76. /etc/localtime r,
  77. /etc/passwd r,
  78. /etc/nsswitch.conf r,
  79. /lib/** rm,
  80. /proc/[0-9]*/** r,
  81. /dev/null rw,
  82. /bin/ps mr,
  83. # We don't need ptrace so we'll deny and ignore the error.
  84. deny ptrace (read, trace),
  85. # Quiet dac_override denials
  86. deny capability dac_override,
  87. deny capability dac_read_search,
  88. deny capability sys_ptrace,
  89. /dev/tty r,
  90. /proc/stat r,
  91. /proc/cpuinfo r,
  92. /proc/meminfo r,
  93. /proc/uptime r,
  94. /sys/devices/system/cpu/online r,
  95. /proc/sys/kernel/pid_max r,
  96. /proc/ r,
  97. /proc/tty/drivers r,
  98. }
  99. profile /sbin/iptables (complain) {
  100. signal (receive) peer=/usr/bin/docker,
  101. capability net_admin,
  102. }
  103. profile /sbin/auplink flags=(attach_disconnected, complain) {
  104. signal (receive) peer=/usr/bin/docker,
  105. capability sys_admin,
  106. capability dac_override,
  107. @{DOCKER_GRAPH_PATH}/aufs/** rw,
  108. @{DOCKER_GRAPH_PATH}/tmp/** rw,
  109. # For user namespaces:
  110. @{DOCKER_GRAPH_PATH}/[0-9]*.[0-9]*/** rw,
  111. /sys/fs/aufs/** r,
  112. /lib/** rm,
  113. /apparmor/.null r,
  114. /dev/null rw,
  115. /etc/ld.so.cache r,
  116. /sbin/auplink rm,
  117. /proc/fs/aufs/** rw,
  118. /proc/[0-9]*/mounts rw,
  119. }
  120. profile /sbin/modprobe /bin/kmod (complain) {
  121. signal (receive) peer=/usr/bin/docker,
  122. capability sys_module,
  123. /etc/ld.so.cache r,
  124. /lib/** rm,
  125. /dev/null rw,
  126. /apparmor/.null rw,
  127. /sbin/modprobe rm,
  128. /bin/kmod rm,
  129. /proc/cmdline r,
  130. /sys/module/** r,
  131. /etc/modprobe.d{/,/**} r,
  132. }
  133. # xz works via pipes, so we do not need access to the filesystem.
  134. profile /usr/bin/xz (complain) {
  135. signal (receive) peer=/usr/bin/docker,
  136. /etc/ld.so.cache r,
  137. /lib/** rm,
  138. /usr/bin/xz rm,
  139. deny /proc/** rw,
  140. deny /sys/** rw,
  141. }
  142. profile /sbin/xtables-multi (attach_disconnected, complain) {
  143. /etc/ld.so.cache r,
  144. /lib/** rm,
  145. /sbin/xtables-multi rm,
  146. /apparmor/.null w,
  147. /dev/null rw,
  148. /proc r,
  149. capability net_raw,
  150. capability net_admin,
  151. network raw,
  152. }
  153. profile /sbin/zfs (attach_disconnected, complain) {
  154. file,
  155. capability,
  156. }
  157. profile /sbin/mke2fs (complain) {
  158. /sbin/mke2fs rm,
  159. /lib/** rm,
  160. /apparmor/.null w,
  161. /etc/ld.so.cache r,
  162. /etc/mke2fs.conf r,
  163. /etc/mtab r,
  164. /dev/dm-* rw,
  165. /dev/urandom r,
  166. /dev/null rw,
  167. /proc/swaps r,
  168. /proc/[0-9]*/mounts r,
  169. }
  170. profile /sbin/tune2fs (complain) {
  171. /sbin/tune2fs rm,
  172. /lib/** rm,
  173. /apparmor/.null w,
  174. /etc/blkid.conf r,
  175. /etc/mtab r,
  176. /etc/ld.so.cache r,
  177. /dev/null rw,
  178. /dev/.blkid.tab r,
  179. /dev/dm-* rw,
  180. /proc/swaps r,
  181. /proc/[0-9]*/mounts r,
  182. }
  183. profile /sbin/blkid (complain) {
  184. /sbin/blkid rm,
  185. /lib/** rm,
  186. /apparmor/.null w,
  187. /etc/ld.so.cache r,
  188. /etc/blkid.conf r,
  189. /dev/null rw,
  190. /dev/.blkid.tab rl,
  191. /dev/.blkid.tab* rwl,
  192. /dev/dm-* r,
  193. /sys/devices/virtual/block/** r,
  194. capability mknod,
  195. mount -> @{DOCKER_GRAPH_PATH}/**,
  196. }
  197. profile /sbin/apparmor_parser (complain) {
  198. /sbin/apparmor_parser rm,
  199. /lib/** rm,
  200. /etc/ld.so.cache r,
  201. /etc/apparmor/** r,
  202. /etc/apparmor.d/** r,
  203. /etc/apparmor.d/cache/** w,
  204. /dev/null rw,
  205. /sys/kernel/security/apparmor/** r,
  206. /sys/kernel/security/apparmor/.replace w,
  207. /proc/[0-9]*/mounts r,
  208. /proc/sys/kernel/osrelease r,
  209. /proc r,
  210. capability mac_admin,
  211. }
  212. }`