mirror of
https://github.com/moby/moby.git
synced 2022-11-09 12:21:53 -05:00
b4a6ccbc5f
These files don't exist under proc so this rule does nothing. They are protected against by docker's default cgroup devices since they're both character devices and not explicitly allowed. Signed-off-by: Tycho Andersen <tycho@docker.com>
44 lines
1.2 KiB
Go
44 lines
1.2 KiB
Go
// +build linux
|
|
|
|
package apparmor
|
|
|
|
// baseTemplate defines the default apparmor profile for containers.
|
|
const baseTemplate = `
|
|
{{range $value := .Imports}}
|
|
{{$value}}
|
|
{{end}}
|
|
|
|
profile {{.Name}} flags=(attach_disconnected,mediate_deleted) {
|
|
{{range $value := .InnerImports}}
|
|
{{$value}}
|
|
{{end}}
|
|
|
|
network,
|
|
capability,
|
|
file,
|
|
umount,
|
|
|
|
deny @{PROC}/* w, # deny write for all files directly in /proc (not in a subdir)
|
|
# deny write to files not in /proc/<number>/** or /proc/sys/**
|
|
deny @{PROC}/{[^1-9],[^1-9][^0-9],[^1-9s][^0-9y][^0-9s],[^1-9][^0-9][^0-9][^0-9]*}/** w,
|
|
deny @{PROC}/sys/[^k]** w, # deny /proc/sys except /proc/sys/k* (effectively /proc/sys/kernel)
|
|
deny @{PROC}/sys/kernel/{?,??,[^s][^h][^m]**} w, # deny everything except shm* in /proc/sys/kernel/
|
|
deny @{PROC}/sysrq-trigger rwklx,
|
|
deny @{PROC}/kcore rwklx,
|
|
|
|
deny mount,
|
|
|
|
deny /sys/[^f]*/** wklx,
|
|
deny /sys/f[^s]*/** wklx,
|
|
deny /sys/fs/[^c]*/** wklx,
|
|
deny /sys/fs/c[^g]*/** wklx,
|
|
deny /sys/fs/cg[^r]*/** wklx,
|
|
deny /sys/firmware/** rwklx,
|
|
deny /sys/kernel/security/** rwklx,
|
|
|
|
{{if ge .Version 208095}}
|
|
# suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
|
|
ptrace (trace,read) peer={{.Name}},
|
|
{{end}}
|
|
}
|
|
`
|