felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

General update

Browse source 
Signed-off-by: Jeroen Rijken <jeroen.rijken@xs4all.nl>
This commit is contained in:
Jeroen Rijken 2023-06-05 21:01:56 +02:00 • committed by Alex
parent 0a468caff2
commit 5ccd92e12f
13 changed files with 127 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

2
apparmor.d/groups/virt/containerd-shim-runc-v2
View file

@ -22,6 +22,8 @@ profile containerd-shim-runc-v2 @{exec_path} flags=(attach_disconnected) {
ptrace (read) peer=containerd,
ptrace (read) peer=unconfined,
signal (send) set=kill peer=cri-containerd.apparmor.d,
mount -> /run/containerd/io.containerd.runtime.v2.task/k8s.io/@{hex}/rootfs/,
umount /run/containerd/io.containerd.runtime.v2.task/k8s.io/@{hex}/rootfs/,

5
apparmor.d/groups/virt/k3s
View file

@ -28,12 +28,15 @@ profile k3s @{exec_path} flags=(attach_disconnected) {
ptrace peer=@{profile_name},
ptrace (read) peer={cni-calico-node,cri-containerd.apparmor.d,cni-xtables-nft,ip,kmod,kubernetes-pause,mount,unconfined},
# k3s requires ptrace to all AppArmor profiles loaded in Kubernetes
# k3s requires ptrace to all AppArmor profiles loaded in Kubernetes.
# For simplification, let's assume for now all AppArmor profiles start with a predefined prefix.
ptrace (read) peer=container-*,
ptrace (read) peer=docker-*,
ptrace (read) peer=k3s-*,
ptrace (read) peer=kubernetes-*,
# When using ZFS as storage provider instead of the default overlay2.
ptrace (read) peer=zfs,
ptrace (read) peer=zpool,
network inet dgram,
network inet6 dgram,