felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

General update

Browse source
This commit is contained in:
Jeroen Rijken 2022-08-01 18:31:32 +02:00 • committed by Alex
parent 575d781c88
commit 099a97cb36
26 changed files with 137 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

2
apparmor.d/groups/virt/containerd
View file

@ -20,7 +20,9 @@ profile containerd @{exec_path} flags=(attach_disconnected) {
capability dac_override,
capability fsetid,
capability fowner,
capability mknod,
capability net_admin,
capability setfcap,
capability sys_admin,
network inet dgram,

2
apparmor.d/groups/virt/k3s
View file

@ -27,7 +27,7 @@ profile k3s @{exec_path} {
capability sys_resource,
ptrace peer=@{profile_name},
ptrace (read) peer={cri-containerd.apparmor.d,cni-xtables-nft,kubernetes-pause,mount,unconfined},
ptrace (read) peer={cri-containerd.apparmor.d,cni-xtables-nft,ip,kubernetes-pause,mount,unconfined},
# k3s requires ptrace to all AppArmor profiles loaded in Kubernetes
# For simplification, let's assume for now all AppArmor profiles start with a predefined prefix.