807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # dbus, signal, ptrace and unix are only supported by recent apparmor
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # versions. Comment them if the apparmor parser doesn't recognize them.
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # This also needs additional rules to reach outside of the container via
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # DBus, so just let all of DBus within the container.
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # Allow us to receive signals from anywhere. Note: if per-container profiles
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # are supported, for container isolation this should be changed to something
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # signal (receive) peer=unconfined,
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # signal (receive) peer=/usr/bin/lxc-start,
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge signal (receive),
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # Allow us to send signals to ourselves
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge signal peer=@{profile_name},
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # Allow other processes to read our /proc entries, futexes, perf tracing and
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # kcmp for now (they will need 'read' in the first place). Administrators can
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # override with:
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # deny ptrace (readby) ...
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge ptrace (readby),
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # Allow other processes to trace us by default (they will need 'trace' in
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # the first place). Administrators can override with:
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # deny ptrace (tracedby) ...
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge ptrace (tracedby),
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # Allow us to ptrace ourselves
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge ptrace peer=@{profile_name},
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # Allow receive via unix sockets from anywhere. Note: if per-container
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # profiles are supported, for container isolation this should be changed to
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # something like:
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # unix (receive) peer=(label=unconfined),
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge unix (receive),
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # Allow all unix in the container
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge unix peer=(label=@{profile_name}),
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn # ignore DENIED message on / remount
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny mount options=(ro, remount) -> /,
097796ac6ca8e14fab3ac6b0db6984d565f57d5dSerge Hallyn deny mount options=(ro, remount, silent) -> /,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn # allow tmpfs mounts everywhere
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn mount fstype=tmpfs,
f2f545857cd6b06689bb1220d66d3577f802dbbcJesse Tane # allow hugetlbfs mounts everywhere
f2f545857cd6b06689bb1220d66d3577f802dbbcJesse Tane mount fstype=hugetlbfs,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn # allow mqueue mounts everywhere
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn mount fstype=mqueue,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn # allow fuse mounts everywhere
b03f1f4ac3666abd032ddc617823213568ad577bStéphane Graber mount fstype=fuse,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn mount fstype=fuse.*,
4845c17aff570c25e05c5347dfdcd577cb108d47Serge Hallyn # deny access under /proc/bus to avoid e.g. messing with pci devices directly
4845c17aff570c25e05c5347dfdcd577cb108d47Serge Hallyn deny @{PROC}/bus/** wklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn # deny writes in /proc/sys/fs but allow binfmt_misc to be mounted
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn mount fstype=binfmt_misc -> /proc/sys/fs/binfmt_misc/,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny @{PROC}/sys/fs/** wklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn # allow efivars to be mounted, writing to it will be blocked though
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn mount fstype=efivarfs -> /sys/firmware/efi/efivars/,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn # block some other dangerous paths
98b745498bf97637f68311f944903777f3ee1e67Stéphane Graber deny @{PROC}/kcore rwklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny @{PROC}/kmem rwklx,
98b745498bf97637f68311f944903777f3ee1e67Stéphane Graber deny @{PROC}/mem rwklx,
98b745498bf97637f68311f944903777f3ee1e67Stéphane Graber deny @{PROC}/sysrq-trigger rwklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn # deny writes in /sys except for /sys/fs/cgroup, also allow
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn # fusectl, securityfs and debugfs to be mounted there (read-only)
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn mount fstype=fusectl -> /sys/fs/fuse/connections/,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn mount fstype=securityfs -> /sys/kernel/security/,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn mount fstype=debugfs -> /sys/kernel/debug/,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny mount fstype=debugfs -> /var/lib/ureadahead/debugfs/,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn mount fstype=proc -> /proc/,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn mount fstype=sysfs -> /sys/,
15966fd0861f6472952d27a0910833c900c7d0a5Stéphane Graber mount options=(rw, nosuid, nodev, noexec, remount) -> /sys/,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn mount options=(move) /sys/fs/cgroup/cgmanager/ -> /sys/fs/cgroup/cgmanager.lower/,
97f9856db3397fad38b9e73976f66b6dc33e82c0Stéphane Graber mount options=(ro, nosuid, nodev, noexec, remount, strictatime) -> /sys/fs/cgroup/,
537188a8eefd6df82995e71f453fce4d6622b110Serge Hallyn # deny reads from debugfs
537188a8eefd6df82995e71f453fce4d6622b110Serge Hallyn deny /sys/kernel/debug/{,**} rwklx,
549a40b6128892112895299e445e0564c3faaea2Stéphane Graber # allow paths to be made slave, shared, private or unbindable
549a40b6128892112895299e445e0564c3faaea2Stéphane Graber # FIXME: This currently doesn't work due to the apparmor parser treating those as allowing all mounts.
549a40b6128892112895299e445e0564c3faaea2Stéphane Graber# mount options=(rw,make-slave) -> **,
549a40b6128892112895299e445e0564c3faaea2Stéphane Graber# mount options=(rw,make-rslave) -> **,
549a40b6128892112895299e445e0564c3faaea2Stéphane Graber# mount options=(rw,make-shared) -> **,
549a40b6128892112895299e445e0564c3faaea2Stéphane Graber# mount options=(rw,make-rshared) -> **,
549a40b6128892112895299e445e0564c3faaea2Stéphane Graber# mount options=(rw,make-private) -> **,
549a40b6128892112895299e445e0564c3faaea2Stéphane Graber# mount options=(rw,make-rprivate) -> **,
549a40b6128892112895299e445e0564c3faaea2Stéphane Graber# mount options=(rw,make-unbindable) -> **,
549a40b6128892112895299e445e0564c3faaea2Stéphane Graber# mount options=(rw,make-runbindable) -> **,
9a1d96120f578d35227895aff3852ef10a9e1b1dStéphane Graber # allow bind-mounts of anything except /proc, /sys and /dev
9a1d96120f578d35227895aff3852ef10a9e1b1dStéphane Graber mount options=(rw,bind) /[^spd]*{,/**},
9a1d96120f578d35227895aff3852ef10a9e1b1dStéphane Graber mount options=(rw,bind) /d[^e]*{,/**},
9a1d96120f578d35227895aff3852ef10a9e1b1dStéphane Graber mount options=(rw,bind) /de[^v]*{,/**},
9a1d96120f578d35227895aff3852ef10a9e1b1dStéphane Graber mount options=(rw,bind) /dev/.[^l]*{,/**},
9a1d96120f578d35227895aff3852ef10a9e1b1dStéphane Graber mount options=(rw,bind) /dev/.l[^x]*{,/**},
9a1d96120f578d35227895aff3852ef10a9e1b1dStéphane Graber mount options=(rw,bind) /dev/.lx[^c]*{,/**},
9a1d96120f578d35227895aff3852ef10a9e1b1dStéphane Graber mount options=(rw,bind) /dev/.lxc?*{,/**},
9a1d96120f578d35227895aff3852ef10a9e1b1dStéphane Graber mount options=(rw,bind) /dev/[^.]*{,/**},
9a1d96120f578d35227895aff3852ef10a9e1b1dStéphane Graber mount options=(rw,bind) /dev?*{,/**},
9a1d96120f578d35227895aff3852ef10a9e1b1dStéphane Graber mount options=(rw,bind) /p[^r]*{,/**},
9a1d96120f578d35227895aff3852ef10a9e1b1dStéphane Graber mount options=(rw,bind) /pr[^o]*{,/**},
9a1d96120f578d35227895aff3852ef10a9e1b1dStéphane Graber mount options=(rw,bind) /pro[^c]*{,/**},
9a1d96120f578d35227895aff3852ef10a9e1b1dStéphane Graber mount options=(rw,bind) /proc?*{,/**},
9a1d96120f578d35227895aff3852ef10a9e1b1dStéphane Graber mount options=(rw,bind) /s[^y]*{,/**},
9a1d96120f578d35227895aff3852ef10a9e1b1dStéphane Graber mount options=(rw,bind) /sy[^s]*{,/**},
9a1d96120f578d35227895aff3852ef10a9e1b1dStéphane Graber mount options=(rw,bind) /sys?*{,/**},
7e4c9a30feb3905902a158cde099f4510a54d5efStéphane Graber # allow moving mounts except for /proc, /sys and /dev
7e4c9a30feb3905902a158cde099f4510a54d5efStéphane Graber mount options=(rw,move) /[^spd]*{,/**},
7e4c9a30feb3905902a158cde099f4510a54d5efStéphane Graber mount options=(rw,move) /d[^e]*{,/**},
7e4c9a30feb3905902a158cde099f4510a54d5efStéphane Graber mount options=(rw,move) /de[^v]*{,/**},
7e4c9a30feb3905902a158cde099f4510a54d5efStéphane Graber mount options=(rw,move) /dev/.[^l]*{,/**},
7e4c9a30feb3905902a158cde099f4510a54d5efStéphane Graber mount options=(rw,move) /dev/.l[^x]*{,/**},
7e4c9a30feb3905902a158cde099f4510a54d5efStéphane Graber mount options=(rw,move) /dev/.lx[^c]*{,/**},
7e4c9a30feb3905902a158cde099f4510a54d5efStéphane Graber mount options=(rw,move) /dev/.lxc?*{,/**},
7e4c9a30feb3905902a158cde099f4510a54d5efStéphane Graber mount options=(rw,move) /dev/[^.]*{,/**},
7e4c9a30feb3905902a158cde099f4510a54d5efStéphane Graber mount options=(rw,move) /dev?*{,/**},
7e4c9a30feb3905902a158cde099f4510a54d5efStéphane Graber mount options=(rw,move) /p[^r]*{,/**},
7e4c9a30feb3905902a158cde099f4510a54d5efStéphane Graber mount options=(rw,move) /pr[^o]*{,/**},
7e4c9a30feb3905902a158cde099f4510a54d5efStéphane Graber mount options=(rw,move) /pro[^c]*{,/**},
7e4c9a30feb3905902a158cde099f4510a54d5efStéphane Graber mount options=(rw,move) /proc?*{,/**},
7e4c9a30feb3905902a158cde099f4510a54d5efStéphane Graber mount options=(rw,move) /s[^y]*{,/**},
7e4c9a30feb3905902a158cde099f4510a54d5efStéphane Graber mount options=(rw,move) /sy[^s]*{,/**},
7e4c9a30feb3905902a158cde099f4510a54d5efStéphane Graber mount options=(rw,move) /sys?*{,/**},