diff --git a/apparmor.d/profiles-a-f/fuse-overlayfs b/apparmor.d/profiles-a-f/fuse-overlayfs new file mode 100644 index 000000000..9041e4d53 --- /dev/null +++ b/apparmor.d/profiles-a-f/fuse-overlayfs @@ -0,0 +1,31 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2021 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = /{usr/,}bin/fuse-overlayfs +profile fuse-overlayfs @{exec_path} { + include + + capability sys_admin, + capability dac_override, + capability dac_read_search, + capability chown, + + @{exec_path} mr, + + mount fstype=fuse.* options=(rw,nodev,noatime) @{user_share_dirs}/containers/storage/overlay/**/ -> **, + + owner @{user_share_dirs}/containers/storage/overlay/{,**} rw, + + @{PROC}/sys/kernel/overflowgid r, + @{PROC}/sys/kernel/overflowuid r, + @{PROC}/sys/fs/pipe-max-size r, + + /dev/fuse rw, + + include if exists +} \ No newline at end of file