diff --git a/apparmor.d/abstractions/lxc/container-base b/apparmor.d/abstractions/lxc/container-base deleted file mode 100644 index a242aa424..000000000 --- a/apparmor.d/abstractions/lxc/container-base +++ /dev/null @@ -1,225 +0,0 @@ - network, - capability, - file, - umount, - - # dbus, signal, ptrace and unix are only supported by recent apparmor - # versions. Comment them if the apparmor parser doesn't recognize them. - - # This also needs additional rules to reach outside of the container via - # DBus, so just let all of DBus within the container. - dbus, - - # Allow us to receive signals from anywhere. Note: if per-container profiles - # are supported, for container isolation this should be changed to something - # like: - # signal (receive) peer=unconfined, - # signal (receive) peer=/usr/bin/lxc-start, - signal (receive), - - # Allow us to send signals to ourselves - signal peer=@{profile_name}, - - # Allow other processes to read our /proc entries, futexes, perf tracing and - # kcmp for now (they will need 'read' in the first place). Administrators can - # override with: - # deny ptrace (readby) ... - ptrace (readby), - - # Allow other processes to trace us by default (they will need 'trace' in - # the first place). Administrators can override with: - # deny ptrace (tracedby) ... - ptrace (tracedby), - - # Allow us to ptrace ourselves - ptrace peer=@{profile_name}, - - # Allow receive via unix sockets from anywhere. Note: if per-container - # profiles are supported, for container isolation this should be changed to - # something like: - # unix (receive) peer=(label=unconfined), - unix (receive), - - # Allow all unix in the container - unix peer=(label=@{profile_name}), - - # ignore DENIED message on / remount - deny mount options=(ro, remount) -> /, - deny mount options=(ro, remount, silent) -> /, - - # allow tmpfs mounts everywhere - mount fstype=tmpfs, - - # allow hugetlbfs mounts everywhere - mount fstype=hugetlbfs, - - # allow mqueue mounts everywhere - mount fstype=mqueue, - - # allow fuse mounts everywhere - mount fstype=fuse, - mount fstype=fuse.*, - - # deny access under /proc/bus to avoid e.g. messing with pci devices directly - deny @{PROC}/bus/** wklx, - - # deny writes in /proc/sys/fs but allow binfmt_misc to be mounted - mount fstype=binfmt_misc -> /proc/sys/fs/binfmt_misc/, - deny @{PROC}/sys/fs/** wklx, - - # allow efivars to be mounted, writing to it will be blocked though - mount fstype=efivarfs -> /sys/firmware/efi/efivars/, - - # block some other dangerous paths - deny @{PROC}/kcore rwklx, - deny @{PROC}/sysrq-trigger rwklx, - deny @{PROC}/acpi/** rwklx, - - # deny writes in /sys except for /sys/fs/cgroup, also allow - # fusectl, securityfs and debugfs to be mounted there (read-only) - mount fstype=fusectl -> /sys/fs/fuse/connections/, - mount fstype=securityfs -> /sys/kernel/security/, - mount fstype=debugfs -> /sys/kernel/debug/, - deny mount fstype=debugfs -> /var/lib/ureadahead/debugfs/, - mount fstype=proc -> /proc/, - mount fstype=sysfs -> /sys/, - mount options=(rw, nosuid, nodev, noexec, remount) -> /sys/, - deny /sys/firmware/efi/efivars/** rwklx, - deny /sys/kernel/security/** rwklx, - mount options=(ro, nosuid, nodev, noexec, remount, strictatime) -> /sys/fs/cgroup/, - - # deny reads from debugfs - deny /sys/kernel/debug/{,**} rwklx, - - # allow paths to be made slave, shared, private or unbindable - # FIXME: This currently doesn't work due to the apparmor parser treating those as allowing all mounts. -# mount options=(rw,make-slave) -> **, -# mount options=(rw,make-rslave) -> **, -# mount options=(rw,make-shared) -> **, -# mount options=(rw,make-rshared) -> **, -# mount options=(rw,make-private) -> **, -# mount options=(rw,make-rprivate) -> **, -# mount options=(rw,make-unbindable) -> **, -# mount options=(rw,make-runbindable) -> **, - - # allow bind-mounts of anything except /proc, /sys and /dev - mount options=(rw,bind) /[^spd]*{,/**}, - mount options=(rw,bind) /d[^e]*{,/**}, - mount options=(rw,bind) /de[^v]*{,/**}, - mount options=(rw,bind) /dev/.[^l]*{,/**}, - mount options=(rw,bind) /dev/.l[^x]*{,/**}, - mount options=(rw,bind) /dev/.lx[^c]*{,/**}, - mount options=(rw,bind) /dev/.lxc?*{,/**}, - mount options=(rw,bind) /dev/[^.]*{,/**}, - mount options=(rw,bind) /dev?*{,/**}, - mount options=(rw,bind) /p[^r]*{,/**}, - mount options=(rw,bind) /pr[^o]*{,/**}, - mount options=(rw,bind) /pro[^c]*{,/**}, - mount options=(rw,bind) /proc?*{,/**}, - mount options=(rw,bind) /s[^y]*{,/**}, - mount options=(rw,bind) /sy[^s]*{,/**}, - mount options=(rw,bind) /sys?*{,/**}, - - # allow various ro-bind-*re*-mounts - mount options=(ro,remount,bind), - mount options=(ro,remount,bind,nosuid), - mount options=(ro,remount,bind,noexec), - mount options=(ro,remount,bind,nodev), - mount options=(ro,remount,bind,nosuid,noexec), - mount options=(ro,remount,bind,noexec,nodev), - mount options=(ro,remount,bind,nodev,nosuid), - mount options=(ro,remount,bind,nosuid,noexec,nodev), - - # allow moving mounts except for /proc, /sys and /dev - mount options=(rw,move) /[^spd]*{,/**}, - mount options=(rw,move) /d[^e]*{,/**}, - mount options=(rw,move) /de[^v]*{,/**}, - mount options=(rw,move) /dev/.[^l]*{,/**}, - mount options=(rw,move) /dev/.l[^x]*{,/**}, - mount options=(rw,move) /dev/.lx[^c]*{,/**}, - mount options=(rw,move) /dev/.lxc?*{,/**}, - mount options=(rw,move) /dev/[^.]*{,/**}, - mount options=(rw,move) /dev?*{,/**}, - mount options=(rw,move) /p[^r]*{,/**}, - mount options=(rw,move) /pr[^o]*{,/**}, - mount options=(rw,move) /pro[^c]*{,/**}, - mount options=(rw,move) /proc?*{,/**}, - mount options=(rw,move) /s[^y]*{,/**}, - mount options=(rw,move) /sy[^s]*{,/**}, - mount options=(rw,move) /sys?*{,/**}, - # generated by: lxc-generate-aa-rules.py container-rules.base - deny /proc/sys/[^kn]*{,/**} wklx, - deny /proc/sys/k[^e]*{,/**} wklx, - deny /proc/sys/ke[^r]*{,/**} wklx, - deny /proc/sys/ker[^n]*{,/**} wklx, - deny /proc/sys/kern[^e]*{,/**} wklx, - deny /proc/sys/kerne[^l]*{,/**} wklx, - deny /proc/sys/kernel/[^smhd]*{,/**} wklx, - deny /proc/sys/kernel/d[^o]*{,/**} wklx, - deny /proc/sys/kernel/do[^m]*{,/**} wklx, - deny /proc/sys/kernel/dom[^a]*{,/**} wklx, - deny /proc/sys/kernel/doma[^i]*{,/**} wklx, - deny /proc/sys/kernel/domai[^n]*{,/**} wklx, - deny /proc/sys/kernel/domain[^n]*{,/**} wklx, - deny /proc/sys/kernel/domainn[^a]*{,/**} wklx, - deny /proc/sys/kernel/domainna[^m]*{,/**} wklx, - deny /proc/sys/kernel/domainnam[^e]*{,/**} wklx, - deny /proc/sys/kernel/domainname?*{,/**} wklx, - deny /proc/sys/kernel/h[^o]*{,/**} wklx, - deny /proc/sys/kernel/ho[^s]*{,/**} wklx, - deny /proc/sys/kernel/hos[^t]*{,/**} wklx, - deny /proc/sys/kernel/host[^n]*{,/**} wklx, - deny /proc/sys/kernel/hostn[^a]*{,/**} wklx, - deny /proc/sys/kernel/hostna[^m]*{,/**} wklx, - deny /proc/sys/kernel/hostnam[^e]*{,/**} wklx, - deny /proc/sys/kernel/hostname?*{,/**} wklx, - deny /proc/sys/kernel/m[^s]*{,/**} wklx, - deny /proc/sys/kernel/ms[^g]*{,/**} wklx, - deny /proc/sys/kernel/msg*/** wklx, - deny /proc/sys/kernel/s[^he]*{,/**} wklx, - deny /proc/sys/kernel/se[^m]*{,/**} wklx, - deny /proc/sys/kernel/sem*/** wklx, - deny /proc/sys/kernel/sh[^m]*{,/**} wklx, - deny /proc/sys/kernel/shm*/** wklx, - deny /proc/sys/kernel?*{,/**} wklx, - deny /proc/sys/n[^e]*{,/**} wklx, - deny /proc/sys/ne[^t]*{,/**} wklx, - deny /proc/sys/net?*{,/**} wklx, - deny /sys/[^fdc]*{,/**} wklx, - deny /sys/c[^l]*{,/**} wklx, - deny /sys/cl[^a]*{,/**} wklx, - deny /sys/cla[^s]*{,/**} wklx, - deny /sys/clas[^s]*{,/**} wklx, - deny /sys/class/[^n]*{,/**} wklx, - deny /sys/class/n[^e]*{,/**} wklx, - deny /sys/class/ne[^t]*{,/**} wklx, - deny /sys/class/net?*{,/**} wklx, - deny /sys/class?*{,/**} wklx, - deny /sys/d[^e]*{,/**} wklx, - deny /sys/de[^v]*{,/**} wklx, - deny /sys/dev[^i]*{,/**} wklx, - deny /sys/devi[^c]*{,/**} wklx, - deny /sys/devic[^e]*{,/**} wklx, - deny /sys/device[^s]*{,/**} wklx, - deny /sys/devices/[^v]*{,/**} wklx, - deny /sys/devices/v[^i]*{,/**} wklx, - deny /sys/devices/vi[^r]*{,/**} wklx, - deny /sys/devices/vir[^t]*{,/**} wklx, - deny /sys/devices/virt[^u]*{,/**} wklx, - deny /sys/devices/virtu[^a]*{,/**} wklx, - deny /sys/devices/virtua[^l]*{,/**} wklx, - deny /sys/devices/virtual/[^n]*{,/**} wklx, - deny /sys/devices/virtual/n[^e]*{,/**} wklx, - deny /sys/devices/virtual/ne[^t]*{,/**} wklx, - deny /sys/devices/virtual/net?*{,/**} wklx, - deny /sys/devices/virtual?*{,/**} wklx, - deny /sys/devices?*{,/**} wklx, - deny /sys/f[^s]*{,/**} wklx, - deny /sys/fs/[^c]*{,/**} wklx, - deny /sys/fs/c[^g]*{,/**} wklx, - deny /sys/fs/cg[^r]*{,/**} wklx, - deny /sys/fs/cgr[^o]*{,/**} wklx, - deny /sys/fs/cgro[^u]*{,/**} wklx, - deny /sys/fs/cgrou[^p]*{,/**} wklx, - deny /sys/fs/cgroup?*{,/**} wklx, - deny /sys/fs?*{,/**} wklx, diff --git a/apparmor.d/abstractions/lxc/start-container b/apparmor.d/abstractions/lxc/start-container deleted file mode 100644 index 9e2e8f2ec..000000000 --- a/apparmor.d/abstractions/lxc/start-container +++ /dev/null @@ -1,50 +0,0 @@ - network, - capability, - file, - - # The following 3 entries are only supported by recent apparmor versions. - # Comment them if the apparmor parser doesn't recognize them. - dbus, - signal, - ptrace, - - # currently blocked by apparmor bug - mount -> /usr/lib*/*/lxc/{**,}, - mount -> /usr/lib*/lxc/{**,}, - mount -> /usr/lib/@{multiarch}/lxc/rootfs/{,**}, - mount fstype=devpts -> /dev/pts/, - mount options=bind /dev/pts/ptmx/ -> /dev/ptmx/, - mount options=bind /dev/pts/** -> /dev/**, - mount options=(rw, make-slave) -> **, - mount options=(rw, make-rslave) -> **, - mount fstype=debugfs, - # allow pre-mount hooks to stage mounts under /var/lib/lxc// - mount -> /var/lib/lxc/{**,}, - - mount /dev/.lxc-boot-id -> /proc/sys/kernel/random/boot_id, - mount options=(ro, nosuid, nodev, noexec, remount, bind) -> /proc/sys/kernel/random/boot_id, - - # required for some pre-mount hooks - mount fstype=overlayfs, - mount fstype=aufs, - mount fstype=ecryptfs, - - # all umounts are under the original root's /mnt, but right now we - # can't allow those umounts after pivot_root. So allow all umounts - # right now. They'll be restricted for the container at least. - umount, - #umount /mnt/{**,}, - - # This may look a bit redundant, however it appears we need all of - # them if we want things to work properly on all combinations of kernel - # and userspace parser... - pivot_root /usr/lib*/lxc/, - pivot_root /usr/lib*/*/lxc/, - pivot_root /usr/lib*/lxc/**, - pivot_root /usr/lib*/*/lxc/**, - pivot_root /usr/lib/x86_64-linux-gnu/lxc/rootfs/{,**}, - - change_profile -> lxc-*, - change_profile -> lxc-**, - change_profile -> unconfined, - change_profile -> :lxc-*:unconfined, diff --git a/apparmor.d/profiles-g-l/lxc-containers b/apparmor.d/profiles-g-l/lxc-containers deleted file mode 100644 index 4e94d77e8..000000000 --- a/apparmor.d/profiles-g-l/lxc-containers +++ /dev/null @@ -1,7 +0,0 @@ -# This file exists only to ensure that all per-container policies -# listed under /etc/apparmor.d/lxc get loaded at boot. Please do -# not edit this file. - -include - -include diff --git a/apparmor.d/profiles-g-l/lxc/lxc-default b/apparmor.d/profiles-g-l/lxc/lxc-default deleted file mode 100644 index 266edc196..000000000 --- a/apparmor.d/profiles-g-l/lxc/lxc-default +++ /dev/null @@ -1,11 +0,0 @@ -# Do not load this file. Rather, load /etc/apparmor.d/lxc-containers, which -# will source all profiles under /etc/apparmor.d/lxc - -profile lxc-container-default flags=(attach_disconnected,mediate_deleted) { - include - - # the container may never be allowed to mount devpts. If it does, it - # will remount the host's devpts. We could allow it to do it with - # the newinstance option (but, right now, we don't). - deny mount fstype=devpts, -} diff --git a/apparmor.d/profiles-g-l/lxc/lxc-default-cgns b/apparmor.d/profiles-g-l/lxc/lxc-default-cgns deleted file mode 100644 index d582a407d..000000000 --- a/apparmor.d/profiles-g-l/lxc/lxc-default-cgns +++ /dev/null @@ -1,13 +0,0 @@ -# Do not load this file. Rather, load /etc/apparmor.d/lxc-containers, which -# will source all profiles under /etc/apparmor.d/lxc - -profile lxc-container-default-cgns flags=(attach_disconnected,mediate_deleted) { - include - - # the container may never be allowed to mount devpts. If it does, it - # will remount the host's devpts. We could allow it to do it with - # the newinstance option (but, right now, we don't). - deny mount fstype=devpts, - mount fstype=cgroup -> /sys/fs/cgroup/**, - mount fstype=cgroup2 -> /sys/fs/cgroup/**, -} diff --git a/apparmor.d/profiles-g-l/lxc/lxc-default-with-mounting b/apparmor.d/profiles-g-l/lxc/lxc-default-with-mounting deleted file mode 100644 index 7b5db2ca1..000000000 --- a/apparmor.d/profiles-g-l/lxc/lxc-default-with-mounting +++ /dev/null @@ -1,14 +0,0 @@ -# Do not load this file. Rather, load /etc/apparmor.d/lxc-containers, which -# will source all profiles under /etc/apparmor.d/lxc - -profile lxc-container-default-with-mounting flags=(attach_disconnected,mediate_deleted) { - include - -# allow standard blockdevtypes. -# The concern here is in-kernel superblock parsers bringing down the -# host with bad data. However, we continue to disallow proc, sys, securityfs, -# etc to nonstandard locations. - mount fstype=ext*, - mount fstype=xfs, - mount fstype=btrfs, -} diff --git a/apparmor.d/profiles-g-l/lxc/lxc-default-with-nesting b/apparmor.d/profiles-g-l/lxc/lxc-default-with-nesting deleted file mode 100644 index 25e3feffc..000000000 --- a/apparmor.d/profiles-g-l/lxc/lxc-default-with-nesting +++ /dev/null @@ -1,15 +0,0 @@ -# Do not load this file. Rather, load /etc/apparmor.d/lxc-containers, which -# will source all profiles under /etc/apparmor.d/lxc - -profile lxc-container-default-with-nesting flags=(attach_disconnected,mediate_deleted) { - include - include - - deny /dev/.lxc/proc/** rw, - deny /dev/.lxc/sys/** rw, - mount fstype=proc -> /var/cache/lxc/**, - mount fstype=sysfs -> /var/cache/lxc/**, - mount options=(rw,bind), - mount fstype=cgroup -> /sys/fs/cgroup/**, - mount fstype=cgroup2 -> /sys/fs/cgroup/**, -} diff --git a/apparmor.d/profiles-s-z/usr.bin.lxc-start b/apparmor.d/profiles-s-z/usr.bin.lxc-start deleted file mode 100644 index e9fdd43b6..000000000 --- a/apparmor.d/profiles-s-z/usr.bin.lxc-start +++ /dev/null @@ -1,5 +0,0 @@ -include - -profile lxc-start /usr/bin/lxc-start flags=(attach_disconnected) { - include -}