felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix for calico unable to create network namespace.

Browse source
This commit is contained in:
Jeroen Rijken 2022-07-19 14:34:31 +02:00 • committed by Alex
parent 5565217c91
commit 3e006e3c76
4 changed files with 48 additions and 38 deletions
Download patch file Download diff file Expand all files Collapse all files

4
apparmor.d/groups/virt/cni-calico
View file

@ -7,13 +7,14 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /opt/cni/bin/calico @{exec_path} = /opt/cni/bin/calico
profile cni-calico @{exec_path} { profile cni-calico @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
network inet dgram, network inet dgram,
network inet6 dgram, network inet6 dgram,
network inet stream, network inet stream,
network inet6 stream, network inet6 stream,
network netlink raw,
@{exec_path} mr, @{exec_path} mr,
@{exec_path}-ipam rix, @{exec_path}-ipam rix,
@ -26,6 +27,7 @@ profile cni-calico @{exec_path} {
@{run}/calico/ rw, @{run}/calico/ rw,
@{run}/calico/ipam.lock rwk, @{run}/calico/ipam.lock rwk,
@{run}/netns/cni-@{uuid} r,
@{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r,

6
apparmor.d/groups/virt/cni-loopback
View file

@ -10,9 +10,13 @@ include <tunables/global>
profile cni-loopback @{exec_path} flags=(attach_disconnected) { profile cni-loopback @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
network netlink raw,
@{exec_path} mr, @{exec_path} mr,
@{run}/netns/ r, / r,
@{run}/netns/ r,
@{run}/netns/cni-@{uuid} rw, @{run}/netns/cni-@{uuid} rw,
@{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r,

75
apparmor.d/groups/virt/containerd
View file

@ -37,37 +37,40 @@ profile containerd @{exec_path} flags=(attach_disconnected) {
signal (receive) set=term peer=dockerd, signal (receive) set=term peer=dockerd,
@{exec_path} mr, @{exec_path} mr,
/{usr/,}{s,}bin/apparmor_parser rPx, /{usr/,}{s,}bin/apparmor_parser rPx,
/{usr/,}bin/containerd-shim-runc-v2 rPUx, /{usr/,}bin/containerd-shim-runc-v2 rPUx,
/{usr/,}bin/kmod rPx, /{usr/,}bin/kmod rPx,
/{usr/,}bin/unpigz rPUx, /{usr/,}bin/unpigz rPUx,
/{usr/,}{local/,}{s,}bin/zfs rPx, /{usr/,}{local/,}{s,}bin/zfs rPx,
/etc/cni/ rw, / r,
/etc/cni/{,**} r,
/etc/cni/net.d/ rw, /etc/cni/ rw,
/etc/cni/{,**} r,
/etc/cni/net.d/ rw,
/etc/containerd/*.toml r, /etc/containerd/*.toml r,
/opt/cni/bin/loopback rPx, /opt/cni/bin/loopback rPx,
/opt/cni/bin/portmap rPx, /opt/cni/bin/portmap rPx,
/opt/cni/bin/bandwidth rPx, /opt/cni/bin/bandwidth rPx,
/opt/cni/bin/calico rPx, /opt/cni/bin/calico rPx,
/opt/containerd/{,**} rw, /opt/containerd/{,**} rw,
/var/lib/cni/results/cni-loopback-@{uuid}-lo wl, /var/lib/cni/results/cni-loopback-@{uuid}-lo wl,
/var/lib/cni/results/cni-loopback-[0-9a-f]*-lo wl,
/var/lib/containerd/{,**} rwk, /var/lib/containerd/{,**} rwk,
/var/lib/containerd/tmpmounts/containerd-mount[0-9]*/** l, /var/lib/containerd/tmpmounts/containerd-mount[0-9]*/** l,
/var/lib/docker/containerd/{,**} rwk, /var/lib/docker/containerd/{,**} rwk,
/var/log/pods/**/[0-9]*.log w, /var/log/pods/**/[0-9]*.log w,
@{run}/calico/ w, @{run}/calico/ w,
@{run}/containerd/{,**} rwk, @{run}/containerd/{,**} rwk,
@{run}/docker/containerd/{,**} rwk, @{run}/docker/containerd/{,**} rwk,
@{run}/netns/ w, @{run}/netns/ w,
@{run}/netns/cni-@{uuid} rw, @{run}/netns/cni-@{uuid} rw,
@{run}/systemd/notify w, @{run}/systemd/notify w,
/tmp/cri-containerd.apparmor.d[0-9]* rwl, /tmp/cri-containerd.apparmor.d[0-9]* rwl,
@ -76,27 +79,27 @@ profile containerd @{exec_path} flags=(attach_disconnected) {
@{sys}/module/apparmor/parameters/enabled r, @{sys}/module/apparmor/parameters/enabled r,
@{PROC}/@{pid}/task/@{tid}/ns/net rw, @{PROC}/@{pid}/task/@{tid}/ns/net rw,
owner @{PROC}/@{pids}/attr/current r, owner @{PROC}/@{pids}/attr/current r,
owner @{PROC}/@{pids}/uid_map r, owner @{PROC}/@{pids}/uid_map r,
owner @{PROC}/@{pids}/mountinfo r, owner @{PROC}/@{pids}/mountinfo r,
@{PROC}/sys/net/core/somaxconn r, @{PROC}/sys/net/core/somaxconn r,
/dev/bsg/ r, /dev/bsg/ r,
/dev/bus/ r, /dev/bus/ r,
/dev/char/ r, /dev/char/ r,
/dev/cpu/ r, /dev/cpu/ r,
/dev/cpu/[0-9]*/ r, /dev/cpu/[0-9]*/ r,
/dev/dma_heap/ r, /dev/dma_heap/ r,
/dev/dri/ r, /dev/dri/ r,
/dev/dri/by-path/ r, /dev/dri/by-path/ r,
/dev/hugepages/ r, /dev/hugepages/ r,
/dev/input/ r, /dev/input/ r,
/dev/input/by-id/ r, /dev/input/by-id/ r,
/dev/input/by-path/ r, /dev/input/by-path/ r,
/dev/net/ r, /dev/net/ r,
/dev/snd/ r, /dev/snd/ r,
/dev/snd/by-path/ r, /dev/snd/by-path/ r,
/dev/vfio/ r, /dev/vfio/ r,
include if exists <local/containerd> include if exists <local/containerd>
} }

1
apparmor.d/groups/virt/k3s
View file

@ -131,6 +131,7 @@ profile k3s @{exec_path} flags=(complain) {
@{sys}/devices/system/cpu/cpu[0-9]*/topology/{,**} r, @{sys}/devices/system/cpu/cpu[0-9]*/topology/{,**} r,
@{sys}/devices/system/cpu/present{,/} r, @{sys}/devices/system/cpu/present{,/} r,
@{sys}/devices/virtual/net/cali[0-9a-f]*/{address,mtu,speed} r,
@{sys}/devices/virtual/net/vxlan.calico/{address,mtu,speed} r, @{sys}/devices/virtual/net/vxlan.calico/{address,mtu,speed} r,
@{sys}/devices/system/node/ r, @{sys}/devices/system/node/ r,
@{sys}/devices/system/node/node[0-9]*/ r, @{sys}/devices/system/node/node[0-9]*/ r,