felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profiles): general update.

Browse source
This commit is contained in:
Alexandre Pujol 2022-07-29 16:47:09 +01:00
parent 58cfe9ad37
commit 2878fa6a2e
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
9 changed files with 16 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

10
apparmor.d/groups/virt/containerd-shim-runc-v2
View file

@ -16,10 +16,14 @@ profile containerd-shim-runc-v2 @{exec_path} flags=(attach_disconnected) {
capability dac_read_search,
capability net_admin,
capability sys_admin,
capability sys_ptrace,
capability sys_resource,
mount -> /run/containerd/io.containerd.runtime.v2.task/k8s.io/[0-9a-z]*/rootfs/,
umount /run/containerd/io.containerd.runtime.v2.task/k8s.io/[0-9a-z]*/rootfs/,
ptrace (read) peer=containerd,
ptrace (read) peer=unconfined,
mount -> /run/containerd/io.containerd.runtime.v2.task/k8s.io/[0-9a-f]*/rootfs/,
umount /run/containerd/io.containerd.runtime.v2.task/k8s.io/[0-9a-f]*/rootfs/,
@{exec_path} mrix,
@ -31,7 +35,7 @@ profile containerd-shim-runc-v2 @{exec_path} flags=(attach_disconnected) {
@{run}/containerd/{,containerd.sock.ttrpc} rw,
@{run}/containerd/io.containerd.grpc.v1.cri/containers/[0-9a-f]*/io/[0-9]*/[0-9a-f]*-{stdin,stdout,stderr} rw,
@{run}/containerd/io.containerd.runtime.v2.task/k8s.io/[0-9a-f]*/{,*} rw,
@{run}/containerd/io.containerd.runtime.v2.task/{moby,k8s.io}/[0-9a-f]*/{,*} rw,
@{run}/containerd/s/{,[0-9a-f]*} rw,
@{run}/docker/containerd/[0-9a-f]*/[0-9a-f]*-{stdin,stdout,stderr} rw,

2
apparmor.d/groups/virt/libvirtd
View file

@ -207,6 +207,8 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) {
@{sys}/fs/cgroup/cgroup.controllers r,
@{sys}/fs/cgroup/machine.slice/* r,
@{sys}/fs/cgroup/machine.slice/machine-qemu*.scope/{,**} rw,
@{sys}/fs/cgroup/net_cls/machine.slice/ rw,
@{sys}/fs/cgroup/net_cls/machine.slice/machine-qemu*.scope/{,**} rw,
owner @{PROC}/@{pid}/mounts r,
owner @{PROC}/@{pid}/fd/ r,