felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Initial containerd-shim-runc support

Browse source
This commit is contained in:
Jeroen Rijken 2022-07-19 17:09:36 +02:00 • committed by Alex
parent 266d5c6dc0
commit eb87e035b8
2 changed files with 45 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
apparmor.d/groups/virt/containerd
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io> # Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# Copyright (C) 2022 Jeroen Rijken
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
@ -29,7 +30,7 @@ profile containerd @{exec_path} flags=(attach_disconnected) {
network netlink raw, network netlink raw,
mount fstype=tmpfs options in (rw, nosuid, nodev, noexec) -> @{run}/containerd/io.containerd.grpc.v1.cri/sandboxes/[0-9a-f]*/shm/, mount fstype=tmpfs options in (rw, nosuid, nodev, noexec) -> @{run}/containerd/io.containerd.grpc.v1.cri/sandboxes/[0-9a-f]*/shm/,
mount fstype=zfs -> /var/lib/containerd/tmpmounts/containerd-mount[0-9]*/, mount -> /var/lib/containerd/tmpmounts/containerd-mount[0-9]*/,
mount options in (rw, bind, nosuid, nodev, noexec) -> @{run}/netns/cni-@{uuid}, mount options in (rw, bind, nosuid, nodev, noexec) -> @{run}/netns/cni-@{uuid},
umount @{run}/containerd/io.containerd.grpc.v1.cri/sandboxes/[0-9a-f]*/shm/, umount @{run}/containerd/io.containerd.grpc.v1.cri/sandboxes/[0-9a-f]*/shm/,

43
apparmor.d/groups/virt/containerd-shim-runc-v2 Normal file
View file

@ -0,0 +1,43 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2022 Jeroen Rijken
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/containerd-shim-runc-v2
profile containerd-shim-runc-v2 @{exec_path} flags=(complain,attach_disconnected) {
include <abstractions/base>
capability dac_read_search,
capability dac_override,
capability net_admin,
capability sys_admin,
capability sys_resource,
mount -> /run/containerd/io.containerd.runtime.v2.task/k8s.io/[0-9a-z]*/rootfs/,
umount /run/containerd/io.containerd.runtime.v2.task/k8s.io/[0-9a-z]*/rootfs/,
@{exec_path} mrix,
/{usr/,}{s,}bin/runc rPUx,
/tmp/runc-process[0-9]* rw,
@{run}/containerd/containerd.sock.ttrpc rw,
@{run}/containerd/io.containerd.grpc.v1.cri/containers/[0-9a-z]*/io/[0-9]*/[0-9a-z]*-stderr rw,
@{run}/containerd/io.containerd.grpc.v1.cri/containers/[0-9a-z]*/io/[0-9]*/[0-9a-z]*-stdout rw,
@{run}/containerd/io.containerd.runtime.v2.task/k8s.io/[0-9a-z]*/{,*} rw,
@{run}/containerd/s/[0-9a-z]* rw,
@{run}/secrets/kubernetes.io/serviceaccount/*/token w,
@{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r,
@{sys}/fs/cgroup/kubepods/{,**} rw,
@{sys}/fs/cgroup/{,**} rw,
@{PROC}/@{pids}/cgroup r,
@{PROC}/@{pids}/oom_score_adj rw,
@{PROC}/sys/net/core/somaxconn r,
include if exists <local/containerd-shim-runc-v2>
}