diff options
| author | Phil Sphicas <phil.sphicas@att.com> | 2019-08-24 13:28:36 -0700 |
|---|---|---|
| committer | Sebastiaan van Stijn <github@gone.nl> | 2022-06-30 21:12:58 +0200 |
| commit | 66f14e4ae9173f6fb7d1e4a7e13632297bdb8d29 (patch) | |
| tree | e22b19feb05de2ad68bd69971f10da44cd390ce2 /profiles | |
| parent | cceead243ea833bb109bbd53f4c3cd496ddcc0a4 (diff) | |
| download | docker-66f14e4ae9173f6fb7d1e4a7e13632297bdb8d29.tar.gz | |
Fix AppArmor profile docker-default /proc/sys rule
The current docker-default AppArmor profile intends to block write
access to everything in `/proc`, except for `/proc/<pid>` and
`/proc/sys/kernel/shm*`.
Currently the rules block access to everything in `/proc/sys`, and do
not successfully allow access to `/proc/sys/kernel/shm*`. Specifically,
a path like /proc/sys/kernel/shmmax matches this part of the pattern:
deny @{PROC}/{[^1-9][^0-9][^0-9][^0-9]* }/** w,
/proc / s y s / kernel /shmmax
This patch updates the rule so that it works as intended.
Closes #39791
Signed-off-by: Phil Sphicas <phil.sphicas@att.com>
Diffstat (limited to 'profiles')
| -rw-r--r-- | profiles/apparmor/template.go | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/profiles/apparmor/template.go b/profiles/apparmor/template.go index 7c8525a71c..ed5892a7f6 100644 --- a/profiles/apparmor/template.go +++ b/profiles/apparmor/template.go @@ -35,7 +35,7 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) { deny @{PROC}/* w, # deny write for all files directly in /proc (not in a subdir) # deny write to files not in /proc/<number>/** or /proc/sys/** - deny @{PROC}/{[^1-9],[^1-9][^0-9],[^1-9s][^0-9y][^0-9s],[^1-9][^0-9][^0-9][^0-9]*}/** w, + deny @{PROC}/{[^1-9],[^1-9][^0-9],[^1-9s][^0-9y][^0-9s],[^1-9][^0-9][^0-9][^0-9/]*}/** w, deny @{PROC}/sys/[^k]** w, # deny /proc/sys except /proc/sys/k* (effectively /proc/sys/kernel) deny @{PROC}/sys/kernel/{?,??,[^s][^h][^m]**} w, # deny everything except shm* in /proc/sys/kernel/ deny @{PROC}/sysrq-trigger rwklx, |