From 5cd6b3eca236df06e66777b15932b1a7fbb2e954 Mon Sep 17 00:00:00 2001 From: Stefan Berger Date: Mon, 12 Oct 2015 10:41:18 -0400 Subject: [PATCH] Adjust docker-default profile when docker daemon is confined Adjust the docker-default profile for when the docker daemon is running in AppArmor confinement. To enable 'docker kill' we need to allow the container to receive kill signals from the daemon. Signed-off-by: Stefan Berger --- daemon/execdriver/native/apparmor.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/daemon/execdriver/native/apparmor.go b/daemon/execdriver/native/apparmor.go index 3aaba98a34..a5906e08a4 100644 --- a/daemon/execdriver/native/apparmor.go +++ b/daemon/execdriver/native/apparmor.go @@ -55,6 +55,12 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) { deny /sys/fs/cg[^r]*/** wklx, deny /sys/firmware/efi/efivars/** rwklx, deny /sys/kernel/security/** rwklx, + + # docker daemon confinement requires explict allow rule for signal + signal (receive) set=(kill,term) peer=/usr/bin/docker, + + # suppress ptrace denails when using 'docker ps' + ptrace (trace,read) peer=docker-default, } `