beenull/moby
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

contrib/apparmor: remove version-conditionals (< 2.9) from template

Browse source 
These conditions were added in 8cf89245f5
to account for old versions of debian/ubuntu (apparmor_parser < 2.9)
that lacked some options;

> This allows us to use the apparmor profile we have in contrib/apparmor/
> and solves the problems where certain functions are not apparent on older
> versions of apparmor_parser on debian/ubuntu.

Those patches were from 2015/2016, and all currently supported distro
versions should now have more current versions than that. Looking at the
oldest supported versions;

Ubuntu 18.04 "Bionic":

    apparmor_parser --version
    AppArmor parser version 2.12
    Copyright (C) 1999-2008 Novell Inc.
    Copyright 2009-2012 Canonical Ltd.

Debian 10 "Buster"

    apparmor_parser --version
    AppArmor parser version 2.13.2
    Copyright (C) 1999-2008 Novell Inc.
    Copyright 2009-2018 Canonical Ltd.

This patch removes the conditionals.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This commit is contained in:
Sebastiaan van Stijn 2023-02-06 20:59:03 +01:00
parent 7008a51449
commit 2e19a4d56b
No known key found for this signature in database
GPG key ID: 76698F39D527CE8C
1 changed files with 0 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
contrib/apparmor/template.go
View file

@ -20,11 +20,9 @@ profile /usr/bin/docker (attach_disconnected, complain) {
umount, umount,
pivot_root, pivot_root,
{{if ge .Version 209000}}
signal (receive) peer=@{profile_name}, signal (receive) peer=@{profile_name},
signal (receive) peer=unconfined, signal (receive) peer=unconfined,
signal (send), signal (send),
{{end}}
network, network,
capability, capability,
owner /** rw, owner /** rw,
@ -47,12 +45,10 @@ profile /usr/bin/docker (attach_disconnected, complain) {
/etc/ld.so.cache r, /etc/ld.so.cache r,
/etc/passwd r, /etc/passwd r,
{{if ge .Version 209000}}
ptrace peer=@{profile_name}, ptrace peer=@{profile_name},
ptrace (read) peer=docker-default, ptrace (read) peer=docker-default,
deny ptrace (trace) peer=docker-default, deny ptrace (trace) peer=docker-default,
deny ptrace peer=/usr/bin/docker///bin/ps, deny ptrace peer=/usr/bin/docker///bin/ps,
{{end}}
/usr/lib/** rm, /usr/lib/** rm,
/lib/** rm, /lib/** rm,
@ -73,11 +69,9 @@ profile /usr/bin/docker (attach_disconnected, complain) {
/sbin/zfs rCx, /sbin/zfs rCx,
/sbin/apparmor_parser rCx, /sbin/apparmor_parser rCx,
{{if ge .Version 209000}}
# Transitions # Transitions
change_profile -> docker-*, change_profile -> docker-*,
change_profile -> unconfined, change_profile -> unconfined,
{{end}}
profile /bin/cat (complain) { profile /bin/cat (complain) {
/etc/ld.so.cache r, /etc/ld.so.cache r,
@ -99,10 +93,8 @@ profile /usr/bin/docker (attach_disconnected, complain) {
/dev/null rw, /dev/null rw,
/bin/ps mr, /bin/ps mr,
{{if ge .Version 209000}}
# We don't need ptrace so we'll deny and ignore the error. # We don't need ptrace so we'll deny and ignore the error.
deny ptrace (read, trace), deny ptrace (read, trace),
{{end}}
# Quiet dac_override denials # Quiet dac_override denials
deny capability dac_override, deny capability dac_override,
@ -120,15 +112,11 @@ profile /usr/bin/docker (attach_disconnected, complain) {
/proc/tty/drivers r, /proc/tty/drivers r,
} }
profile /sbin/iptables (complain) { profile /sbin/iptables (complain) {
{{if ge .Version 209000}}
signal (receive) peer=/usr/bin/docker, signal (receive) peer=/usr/bin/docker,
{{end}}
capability net_admin, capability net_admin,
} }
profile /sbin/auplink flags=(attach_disconnected, complain) { profile /sbin/auplink flags=(attach_disconnected, complain) {
{{if ge .Version 209000}}
signal (receive) peer=/usr/bin/docker, signal (receive) peer=/usr/bin/docker,
{{end}}
capability sys_admin, capability sys_admin,
capability dac_override, capability dac_override,
@ -147,9 +135,7 @@ profile /usr/bin/docker (attach_disconnected, complain) {
/proc/[0-9]*/mounts rw, /proc/[0-9]*/mounts rw,
} }
profile /sbin/modprobe /bin/kmod (complain) { profile /sbin/modprobe /bin/kmod (complain) {
{{if ge .Version 209000}}
signal (receive) peer=/usr/bin/docker, signal (receive) peer=/usr/bin/docker,
{{end}}
capability sys_module, capability sys_module,
/etc/ld.so.cache r, /etc/ld.so.cache r,
/lib/** rm, /lib/** rm,