From 66f14e4ae9173f6fb7d1e4a7e13632297bdb8d29 Mon Sep 17 00:00:00 2001 From: Phil Sphicas Date: Sat, 24 Aug 2019 13:28:36 -0700 Subject: [PATCH] Fix AppArmor profile docker-default /proc/sys rule The current docker-default AppArmor profile intends to block write access to everything in `/proc`, except for `/proc/` and `/proc/sys/kernel/shm*`. Currently the rules block access to everything in `/proc/sys`, and do not successfully allow access to `/proc/sys/kernel/shm*`. Specifically, a path like /proc/sys/kernel/shmmax matches this part of the pattern: deny @{PROC}/{[^1-9][^0-9][^0-9][^0-9]* }/** w, /proc / s y s / kernel /shmmax This patch updates the rule so that it works as intended. Closes #39791 Signed-off-by: Phil Sphicas --- profiles/apparmor/template.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/profiles/apparmor/template.go b/profiles/apparmor/template.go index 7c8525a71c..ed5892a7f6 100644 --- a/profiles/apparmor/template.go +++ b/profiles/apparmor/template.go @@ -35,7 +35,7 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) { deny @{PROC}/* w, # deny write for all files directly in /proc (not in a subdir) # deny write to files not in /proc//** or /proc/sys/** - deny @{PROC}/{[^1-9],[^1-9][^0-9],[^1-9s][^0-9y][^0-9s],[^1-9][^0-9][^0-9][^0-9]*}/** w, + deny @{PROC}/{[^1-9],[^1-9][^0-9],[^1-9s][^0-9y][^0-9s],[^1-9][^0-9][^0-9][^0-9/]*}/** w, deny @{PROC}/sys/[^k]** w, # deny /proc/sys except /proc/sys/k* (effectively /proc/sys/kernel) deny @{PROC}/sys/kernel/{?,??,[^s][^h][^m]**} w, # deny everything except shm* in /proc/sys/kernel/ deny @{PROC}/sysrq-trigger rwklx,