container-base revision 056f8bba0d86ca2ba481a932f23faff9db2ef588
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # dbus, signal, ptrace and unix are only supported by recent apparmor
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # versions. Comment them if the apparmor parser doesn't recognize them.
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # This also needs additional rules to reach outside of the container via
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # DBus, so just let all of DBus within the container.
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # Allow us to receive signals from anywhere. Note: if per-container profiles
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # are supported, for container isolation this should be changed to something
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # signal (receive) peer=unconfined,
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # signal (receive) peer=/usr/bin/lxc-start,
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge signal (receive),
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # Allow us to send signals to ourselves
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge signal peer=@{profile_name},
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # Allow other processes to read our /proc entries, futexes, perf tracing and
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # kcmp for now (they will need 'read' in the first place). Administrators can
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # override with:
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # deny ptrace (readby) ...
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge ptrace (readby),
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # Allow other processes to trace us by default (they will need 'trace' in
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # the first place). Administrators can override with:
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # deny ptrace (tracedby) ...
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge ptrace (tracedby),
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # Allow us to ptrace ourselves
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge ptrace peer=@{profile_name},
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # Allow receive via unix sockets from anywhere. Note: if per-container
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # profiles are supported, for container isolation this should be changed to
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # something like:
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # unix (receive) peer=(label=unconfined),
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge unix (receive),
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge # Allow all unix in the container
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge unix peer=(label=@{profile_name}),
8da250dad4b11c4983031742a83fb8f358044fe0Stéphane Graber # ignore DENIED message on / remount
8da250dad4b11c4983031742a83fb8f358044fe0Stéphane Graber deny mount options=(ro, remount) -> /,
807f4c9e1eaae674c76fd3a97d0b4a8810004177Jamie Strandboge deny mount options=(ro, remount, silent) -> /,
8da250dad4b11c4983031742a83fb8f358044fe0Stéphane Graber # allow tmpfs mounts everywhere
8da250dad4b11c4983031742a83fb8f358044fe0Stéphane Graber mount fstype=tmpfs,
f2f545857cd6b06689bb1220d66d3577f802dbbcJesse Tane # allow hugetlbfs mounts everywhere
f2f545857cd6b06689bb1220d66d3577f802dbbcJesse Tane mount fstype=hugetlbfs,
8da250dad4b11c4983031742a83fb8f358044fe0Stéphane Graber # allow mqueue mounts everywhere
8da250dad4b11c4983031742a83fb8f358044fe0Stéphane Graber mount fstype=mqueue,
8da250dad4b11c4983031742a83fb8f358044fe0Stéphane Graber # allow fuse mounts everywhere
8da250dad4b11c4983031742a83fb8f358044fe0Stéphane Graber mount fstype=fuse.*,
8da250dad4b11c4983031742a83fb8f358044fe0Stéphane Graber # allow bind mount of /lib/init/fstab for lxcguest
8da250dad4b11c4983031742a83fb8f358044fe0Stéphane Graber mount options=(rw, bind) /lib/init/fstab.lxc/ -> /lib/init/fstab/,
056f8bba0d86ca2ba481a932f23faff9db2ef588Stéphane Graber # allow bind mounts of /run/{,lock} to /var/run/{,lock}
056f8bba0d86ca2ba481a932f23faff9db2ef588Stéphane Graber mount options=(rw, bind) /run/ -> /var/run/,
056f8bba0d86ca2ba481a932f23faff9db2ef588Stéphane Graber mount options=(rw, bind) /run/lock/ -> /var/lock/,
8da250dad4b11c4983031742a83fb8f358044fe0Stéphane Graber # deny writes in /proc/sys/fs but allow binfmt_misc to be mounted
8da250dad4b11c4983031742a83fb8f358044fe0Stéphane Graber mount fstype=binfmt_misc -> /proc/sys/fs/binfmt_misc/,
8da250dad4b11c4983031742a83fb8f358044fe0Stéphane Graber deny @{PROC}/sys/fs/** wklx,
8da250dad4b11c4983031742a83fb8f358044fe0Stéphane Graber # allow efivars to be mounted, writing to it will be blocked though
8da250dad4b11c4983031742a83fb8f358044fe0Stéphane Graber mount fstype=efivarfs -> /sys/firmware/efi/efivars/,
8da250dad4b11c4983031742a83fb8f358044fe0Stéphane Graber # block some other dangerous paths
98b745498bf97637f68311f944903777f3ee1e67Stéphane Graber deny @{PROC}/kcore rwklx,
8da250dad4b11c4983031742a83fb8f358044fe0Stéphane Graber deny @{PROC}/kmem rwklx,
98b745498bf97637f68311f944903777f3ee1e67Stéphane Graber deny @{PROC}/mem rwklx,
98b745498bf97637f68311f944903777f3ee1e67Stéphane Graber deny @{PROC}/sysrq-trigger rwklx,
8da250dad4b11c4983031742a83fb8f358044fe0Stéphane Graber # deny writes in /sys except for /sys/fs/cgroup, also allow
8da250dad4b11c4983031742a83fb8f358044fe0Stéphane Graber # fusectl, securityfs and debugfs to be mounted there (read-only)
8da250dad4b11c4983031742a83fb8f358044fe0Stéphane Graber mount fstype=fusectl -> /sys/fs/fuse/connections/,
8da250dad4b11c4983031742a83fb8f358044fe0Stéphane Graber mount fstype=securityfs -> /sys/kernel/security/,
8da250dad4b11c4983031742a83fb8f358044fe0Stéphane Graber mount fstype=debugfs -> /sys/kernel/debug/,
8da250dad4b11c4983031742a83fb8f358044fe0Stéphane Graber deny mount fstype=debugfs -> /var/lib/ureadahead/debugfs/,
8da250dad4b11c4983031742a83fb8f358044fe0Stéphane Graber mount fstype=proc -> /proc/,
8da250dad4b11c4983031742a83fb8f358044fe0Stéphane Graber mount fstype=sysfs -> /sys/,
056f8bba0d86ca2ba481a932f23faff9db2ef588Stéphane Graber mount options=(rw, nosuid, nodev, noexec, remount) -> /sys/,
c08a0b7c4e459f32a939391bc5c9667eb7c7ab5cSerge Hallyn mount options=(move) /sys/fs/cgroup/cgmanager/ -> /sys/fs/cgroup/cgmanager.lower/,
056f8bba0d86ca2ba481a932f23faff9db2ef588Stéphane Graber mount options=(ro, nosuid, nodev, noexec, remount, strictatime) -> /sys/fs/cgroup/,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn # generated by: lxc-generate-aa-rules.py container-rules.base
94a77f3fd8be2fb87f7d1465521fac3ec4b7e6b5Serge Hallyn deny /proc/sys/[^kn]*{,/**} wklx,
94a77f3fd8be2fb87f7d1465521fac3ec4b7e6b5Serge Hallyn deny /proc/sys/k[^e]*{,/**} wklx,
94a77f3fd8be2fb87f7d1465521fac3ec4b7e6b5Serge Hallyn deny /proc/sys/ke[^r]*{,/**} wklx,
94a77f3fd8be2fb87f7d1465521fac3ec4b7e6b5Serge Hallyn deny /proc/sys/ker[^n]*{,/**} wklx,
94a77f3fd8be2fb87f7d1465521fac3ec4b7e6b5Serge Hallyn deny /proc/sys/kern[^e]*{,/**} wklx,
94a77f3fd8be2fb87f7d1465521fac3ec4b7e6b5Serge Hallyn deny /proc/sys/kerne[^l]*{,/**} wklx,
773bd28258371ad0058ff946c5cf94419920ffddSerge Hallyn deny /proc/sys/kernel/[^smhd]*{,/**} wklx,
94a77f3fd8be2fb87f7d1465521fac3ec4b7e6b5Serge Hallyn deny /proc/sys/kernel/d[^o]*{,/**} wklx,
94a77f3fd8be2fb87f7d1465521fac3ec4b7e6b5Serge Hallyn deny /proc/sys/kernel/do[^m]*{,/**} wklx,
94a77f3fd8be2fb87f7d1465521fac3ec4b7e6b5Serge Hallyn deny /proc/sys/kernel/dom[^a]*{,/**} wklx,
94a77f3fd8be2fb87f7d1465521fac3ec4b7e6b5Serge Hallyn deny /proc/sys/kernel/doma[^i]*{,/**} wklx,
94a77f3fd8be2fb87f7d1465521fac3ec4b7e6b5Serge Hallyn deny /proc/sys/kernel/domai[^n]*{,/**} wklx,
94a77f3fd8be2fb87f7d1465521fac3ec4b7e6b5Serge Hallyn deny /proc/sys/kernel/domain[^n]*{,/**} wklx,
94a77f3fd8be2fb87f7d1465521fac3ec4b7e6b5Serge Hallyn deny /proc/sys/kernel/domainn[^a]*{,/**} wklx,
94a77f3fd8be2fb87f7d1465521fac3ec4b7e6b5Serge Hallyn deny /proc/sys/kernel/domainna[^m]*{,/**} wklx,
94a77f3fd8be2fb87f7d1465521fac3ec4b7e6b5Serge Hallyn deny /proc/sys/kernel/domainnam[^e]*{,/**} wklx,
94a77f3fd8be2fb87f7d1465521fac3ec4b7e6b5Serge Hallyn deny /proc/sys/kernel/domainname?*{,/**} wklx,
94a77f3fd8be2fb87f7d1465521fac3ec4b7e6b5Serge Hallyn deny /proc/sys/kernel/h[^o]*{,/**} wklx,
94a77f3fd8be2fb87f7d1465521fac3ec4b7e6b5Serge Hallyn deny /proc/sys/kernel/ho[^s]*{,/**} wklx,
94a77f3fd8be2fb87f7d1465521fac3ec4b7e6b5Serge Hallyn deny /proc/sys/kernel/hos[^t]*{,/**} wklx,
94a77f3fd8be2fb87f7d1465521fac3ec4b7e6b5Serge Hallyn deny /proc/sys/kernel/host[^n]*{,/**} wklx,
94a77f3fd8be2fb87f7d1465521fac3ec4b7e6b5Serge Hallyn deny /proc/sys/kernel/hostn[^a]*{,/**} wklx,
94a77f3fd8be2fb87f7d1465521fac3ec4b7e6b5Serge Hallyn deny /proc/sys/kernel/hostna[^m]*{,/**} wklx,
94a77f3fd8be2fb87f7d1465521fac3ec4b7e6b5Serge Hallyn deny /proc/sys/kernel/hostnam[^e]*{,/**} wklx,
94a77f3fd8be2fb87f7d1465521fac3ec4b7e6b5Serge Hallyn deny /proc/sys/kernel/hostname?*{,/**} wklx,
773bd28258371ad0058ff946c5cf94419920ffddSerge Hallyn deny /proc/sys/kernel/m[^s]*{,/**} wklx,
773bd28258371ad0058ff946c5cf94419920ffddSerge Hallyn deny /proc/sys/kernel/ms[^g]*{,/**} wklx,
773bd28258371ad0058ff946c5cf94419920ffddSerge Hallyn deny /proc/sys/kernel/s[^he]*{,/**} wklx,
773bd28258371ad0058ff946c5cf94419920ffddSerge Hallyn deny /proc/sys/kernel/se[^m]*{,/**} wklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny /proc/sys/kernel/sh[^m]*{,/**} wklx,
94a77f3fd8be2fb87f7d1465521fac3ec4b7e6b5Serge Hallyn deny /proc/sys/kernel?*{,/**} wklx,
94a77f3fd8be2fb87f7d1465521fac3ec4b7e6b5Serge Hallyn deny /proc/sys/n[^e]*{,/**} wklx,
94a77f3fd8be2fb87f7d1465521fac3ec4b7e6b5Serge Hallyn deny /proc/sys/ne[^t]*{,/**} wklx,
94a77f3fd8be2fb87f7d1465521fac3ec4b7e6b5Serge Hallyn deny /proc/sys/net?*{,/**} wklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny /sys/[^fdc]*{,/**} wklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny /sys/c[^l]*{,/**} wklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny /sys/cl[^a]*{,/**} wklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny /sys/cla[^s]*{,/**} wklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny /sys/clas[^s]*{,/**} wklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny /sys/class/[^n]*{,/**} wklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny /sys/class/n[^e]*{,/**} wklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny /sys/class/ne[^t]*{,/**} wklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny /sys/class/net?*{,/**} wklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny /sys/class?*{,/**} wklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny /sys/d[^e]*{,/**} wklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny /sys/de[^v]*{,/**} wklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny /sys/dev[^i]*{,/**} wklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny /sys/devi[^c]*{,/**} wklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny /sys/devic[^e]*{,/**} wklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny /sys/device[^s]*{,/**} wklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny /sys/devices/[^v]*{,/**} wklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny /sys/devices/v[^i]*{,/**} wklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny /sys/devices/vi[^r]*{,/**} wklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny /sys/devices/vir[^t]*{,/**} wklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny /sys/devices/virt[^u]*{,/**} wklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny /sys/devices/virtu[^a]*{,/**} wklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny /sys/devices/virtua[^l]*{,/**} wklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny /sys/devices/virtual/[^n]*{,/**} wklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny /sys/devices/virtual/n[^e]*{,/**} wklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny /sys/devices/virtual/ne[^t]*{,/**} wklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny /sys/devices/virtual/net?*{,/**} wklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny /sys/devices/virtual?*{,/**} wklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny /sys/devices?*{,/**} wklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny /sys/f[^s]*{,/**} wklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny /sys/fs/[^c]*{,/**} wklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny /sys/fs/c[^g]*{,/**} wklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny /sys/fs/cg[^r]*{,/**} wklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny /sys/fs/cgr[^o]*{,/**} wklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny /sys/fs/cgro[^u]*{,/**} wklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny /sys/fs/cgrou[^p]*{,/**} wklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny /sys/fs/cgroup?*{,/**} wklx,
198b363fff1de9afcee2f26b9aa847316f589afeSerge Hallyn deny /sys/fs?*{,/**} wklx,