# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
# Copyright (C) 2022 Jeroen Rijken
# SPDX-License-Identifier: GPL-2.0-only

abi <abi/3.0>,

include <tunables/global>

@{exec_path} = @{bin}/containerd-shim-runc-v2
profile containerd-shim-runc-v2 @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
  include <abstractions/consoles>

  capability dac_override,
  capability dac_read_search,
  capability net_admin,
  capability sys_admin,
  capability sys_ptrace,
  capability sys_resource,

  ptrace (read) peer=containerd,
  ptrace (read) peer=unconfined,

  signal (send) set=kill peer=cri-containerd.apparmor.d,
  signal (receive) set=kill peer=containerd,

  mount -> /run/containerd/io.containerd.runtime.v2.task/k8s.io/@{hex}/rootfs/,
  umount /run/containerd/io.containerd.runtime.v2.task/k8s.io/@{hex}/rootfs/,

  @{exec_path} mrix,

  @{bin}/runc rPUx,

  /tmp/runc-process@{int} rw,
  /tmp/pty@{int}/ rw,
  /tmp/pty@{int}/pty.sock rw,

  @{run}/containerd/{,containerd.sock.ttrpc} rw,
  @{run}/containerd/io.containerd.grpc.v1.cri/containers/@{hex}/io/@{int}/@{hex}-{stdin,stdout,stderr} rw,
  @{run}/containerd/io.containerd.runtime.v2.task/{moby,k8s.io}/@{hex}/{,*} rw,
  @{run}/containerd/s/{,@{hex}} rw,

  @{run}/docker/containerd/@{hex}/@{hex}-{stdin,stdout,stderr} rw,
  @{run}/docker/containerd/@{hex}/init-{stdin,stdout,stderr} rw,
  @{run}/docker/containerd/daemon/io.containerd.*/{,**} rw,
  @{run}/secrets/kubernetes.io/serviceaccount/*/token w,

  @{sys}/fs/cgroup/{,**} rw,
  @{sys}/fs/cgroup/kubepods/{,**} rw,
  @{sys}/kernel/mm/hugepages/ r,
  @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r,

  @{PROC}/@{pids}/cgroup r,
  @{PROC}/@{pids}/mountinfo r,
  @{PROC}/@{pids}/oom_score_adj rw,
  @{PROC}/sys/net/core/somaxconn r,

  include if exists <local/containerd-shim-runc-v2>
}