10139N/A network,

10139N/A capability,

10139N/A file,

17185N/A umount,

13600N/A

10139N/A # dbus, signal, ptrace and unix are only supported by recent apparmor

10139N/A # versions. Comment them if the apparmor parser doesn't recognize them.

10139N/A

10139N/A # This also needs additional rules to reach outside of the container via

10139N/A # DBus, so just let all of DBus within the container.

10139N/A dbus,

10139N/A

17811N/A # Allow us to receive signals from anywhere. Note: if per-container profiles

18176N/A # are supported, for container isolation this should be changed to something

10139N/A # like:

10139N/A # signal (receive) peer=unconfined,

10139N/A # signal (receive) peer=/usr/bin/lxc-start,

10139N/A signal (receive),

10139N/A

17338N/A # Allow us to send signals to ourselves

10139N/A signal peer=@{profile_name},

10139N/A

15536N/A # Allow other processes to read our /proc entries, futexes, perf tracing and

17811N/A # kcmp for now (they will need 'read' in the first place). Administrators can

17811N/A # override with:

17811N/A # deny ptrace (readby) ...

15761N/A ptrace (readby),

16554N/A

17811N/A # Allow other processes to trace us by default (they will need 'trace' in

16554N/A # the first place). Administrators can override with:

10139N/A # deny ptrace (tracedby) ...

16633N/A ptrace (tracedby),

11999N/A

15536N/A # Allow us to ptrace ourselves

10139N/A ptrace peer=@{profile_name},

10139N/A

10139N/A # Allow receive via unix sockets from anywhere. Note: if per-container

15536N/A # profiles are supported, for container isolation this should be changed to

10139N/A # something like:

12830N/A # unix (receive) peer=(label=unconfined),

12830N/A unix (receive),

17811N/A

12830N/A # Allow all unix in the container

13914N/A unix peer=(label=@{profile_name}),

13915N/A

17811N/A # ignore DENIED message on / remount

14425N/A deny mount options=(ro, remount) -> /,

16680N/A deny mount options=(ro, remount, silent) -> /,

17811N/A

17811N/A # allow tmpfs mounts everywhere

15190N/A mount fstype=tmpfs,

16597N/A

15536N/A # allow hugetlbfs mounts everywhere

17811N/A mount fstype=hugetlbfs,

15216N/A

15418N/A # allow mqueue mounts everywhere

17811N/A mount fstype=mqueue,

15418N/A

16554N/A # allow fuse mounts everywhere

16554N/A mount fstype=fuse.*,

17811N/A

16554N/A # allow bind mount of /lib/init/fstab for lxcguest

16554N/A mount options=(rw, bind) /lib/init/fstab.lxc/ -> /lib/init/fstab/,

16597N/A

17811N/A # allow bind mounts of /run/{,lock} to /var/run/{,lock}

17811N/A mount options=(rw, bind) /run/ -> /var/run/,

15516N/A mount options=(rw, bind) /run/lock/ -> /var/lock/,

17338N/A

17811N/A # deny access under /proc/bus to avoid e.g. messing with pci devices directly

17811N/A deny @{PROC}/bus/** wklx,

17811N/A

17811N/A # deny writes in /proc/sys/fs but allow binfmt_misc to be mounted

17811N/A mount fstype=binfmt_misc -> /proc/sys/fs/binfmt_misc/,

17338N/A deny @{PROC}/sys/fs/** wklx,

15536N/A

17811N/A # allow efivars to be mounted, writing to it will be blocked though

15529N/A mount fstype=efivarfs -> /sys/firmware/efi/efivars/,

17811N/A

17811N/A # block some other dangerous paths

15761N/A deny @{PROC}/kcore rwklx,

16020N/A deny @{PROC}/kmem rwklx,

16020N/A deny @{PROC}/mem rwklx,

17811N/A deny @{PROC}/sysrq-trigger rwklx,

16020N/A

16020N/A # deny writes in /sys except for /sys/fs/cgroup, also allow

17964N/A # fusectl, securityfs and debugfs to be mounted there (read-only)

17811N/A mount fstype=fusectl -> /sys/fs/fuse/connections/,

17811N/A mount fstype=securityfs -> /sys/kernel/security/,

17811N/A mount fstype=debugfs -> /sys/kernel/debug/,

17811N/A deny mount fstype=debugfs -> /var/lib/ureadahead/debugfs/,

16549N/A mount fstype=proc -> /proc/,

17811N/A mount fstype=sysfs -> /sys/,

17811N/A mount options=(rw, nosuid, nodev, noexec, remount) -> /sys/,

16532N/A deny /sys/firmware/efi/efivars/** rwklx,

17811N/A deny /sys/kernel/security/** rwklx,

17811N/A mount options=(move) /sys/fs/cgroup/cgmanager/ -> /sys/fs/cgroup/cgmanager.lower/,

17811N/A mount options=(ro, nosuid, nodev, noexec, remount, strictatime) -> /sys/fs/cgroup/,

17964N/A

17964N/A # deny reads from debugfs

17964N/A deny /sys/kernel/debug/{,**} rwklx,

17964N/A

17964N/A # generated by: lxc-generate-aa-rules.py container-rules.base

17964N/A deny /proc/sys/[^kn]*{,/**} wklx,

16801N/A deny /proc/sys/k[^e]*{,/**} wklx,

18036N/A deny /proc/sys/ke[^r]*{,/**} wklx,

18036N/A deny /proc/sys/ker[^n]*{,/**} wklx,

18036N/A deny /proc/sys/kern[^e]*{,/**} wklx,

18036N/A deny /proc/sys/kerne[^l]*{,/**} wklx,

18190N/A deny /proc/sys/kernel/[^smhd]*{,/**} wklx,

18190N/A deny /proc/sys/kernel/d[^o]*{,/**} wklx,

18190N/A deny /proc/sys/kernel/do[^m]*{,/**} wklx,

18251N/A deny /proc/sys/kernel/dom[^a]*{,/**} wklx,

18251N/A deny /proc/sys/kernel/doma[^i]*{,/**} wklx,

18251N/A deny /proc/sys/kernel/domai[^n]*{,/**} wklx,

18251N/A deny /proc/sys/kernel/domain[^n]*{,/**} wklx,

15536N/A deny /proc/sys/kernel/domainn[^a]*{,/**} wklx,

10139N/A deny /proc/sys/kernel/domainna[^m]*{,/**} wklx,

10139N/A deny /proc/sys/kernel/domainnam[^e]*{,/**} wklx,

10139N/A deny /proc/sys/kernel/domainname?*{,/**} wklx,

10139N/A deny /proc/sys/kernel/h[^o]*{,/**} wklx,

10139N/A deny /proc/sys/kernel/ho[^s]*{,/**} wklx,

10139N/A deny /proc/sys/kernel/hos[^t]*{,/**} wklx,

10139N/A deny /proc/sys/kernel/host[^n]*{,/**} wklx,

10139N/A deny /proc/sys/kernel/hostn[^a]*{,/**} wklx,

10139N/A deny /proc/sys/kernel/hostna[^m]*{,/**} wklx,

10139N/A deny /proc/sys/kernel/hostnam[^e]*{,/**} wklx,

10139N/A deny /proc/sys/kernel/hostname?*{,/**} wklx,

10139N/A deny /proc/sys/kernel/m[^s]*{,/**} wklx,

16554N/A deny /proc/sys/kernel/ms[^g]*{,/**} wklx,

10139N/A deny /proc/sys/kernel/msg*/** wklx,

13898N/A deny /proc/sys/kernel/s[^he]*{,/**} wklx,

13898N/A deny /proc/sys/kernel/se[^m]*{,/**} wklx,

13898N/A deny /proc/sys/kernel/sem*/** wklx,

10139N/A deny /proc/sys/kernel/sh[^m]*{,/**} wklx,

10139N/A deny /proc/sys/kernel/shm*/** wklx,

10139N/A deny /proc/sys/kernel?*{,/**} wklx,

10139N/A deny /proc/sys/n[^e]*{,/**} wklx,

10139N/A deny /proc/sys/ne[^t]*{,/**} wklx,

10139N/A deny /proc/sys/net?*{,/**} wklx,

10139N/A deny /sys/[^fdc]*{,/**} wklx,

10139N/A deny /sys/c[^l]*{,/**} wklx,

10139N/A deny /sys/cl[^a]*{,/**} wklx,

10139N/A deny /sys/cla[^s]*{,/**} wklx,

10139N/A deny /sys/clas[^s]*{,/**} wklx,

10139N/A deny /sys/class/[^n]*{,/**} wklx,

10139N/A deny /sys/class/n[^e]*{,/**} wklx,

10139N/A deny /sys/class/ne[^t]*{,/**} wklx,

10139N/A deny /sys/class/net?*{,/**} wklx,

10139N/A deny /sys/class?*{,/**} wklx,

17811N/A deny /sys/d[^e]*{,/**} wklx,

15536N/A deny /sys/de[^v]*{,/**} wklx,

10139N/A deny /sys/dev[^i]*{,/**} wklx,

15536N/A deny /sys/devi[^c]*{,/**} wklx,

17811N/A deny /sys/devic[^e]*{,/**} wklx,

10139N/A deny /sys/device[^s]*{,/**} wklx,

15536N/A deny /sys/devices/[^v]*{,/**} wklx,

15536N/A deny /sys/devices/v[^i]*{,/**} wklx,

10139N/A deny /sys/devices/vi[^r]*{,/**} wklx,

15536N/A deny /sys/devices/vir[^t]*{,/**} wklx,

17811N/A deny /sys/devices/virt[^u]*{,/**} wklx,

17811N/A deny /sys/devices/virtu[^a]*{,/**} wklx,

10139N/A deny /sys/devices/virtua[^l]*{,/**} wklx,

17338N/A deny /sys/devices/virtual/[^n]*{,/**} wklx,

17811N/A deny /sys/devices/virtual/n[^e]*{,/**} wklx,

17811N/A deny /sys/devices/virtual/ne[^t]*{,/**} wklx,

17811N/A deny /sys/devices/virtual/net?*{,/**} wklx,

15536N/A deny /sys/devices/virtual?*{,/**} wklx,

17964N/A deny /sys/devices?*{,/**} wklx,

18036N/A deny /sys/f[^s]*{,/**} wklx,

18190N/A deny /sys/fs/[^c]*{,/**} wklx,

18251N/A deny /sys/fs/c[^g]*{,/**} wklx,

16050N/A deny /sys/fs/cg[^r]*{,/**} wklx,

16020N/A deny /sys/fs/cgr[^o]*{,/**} wklx,

17811N/A deny /sys/fs/cgro[^u]*{,/**} wklx,

16020N/A deny /sys/fs/cgrou[^p]*{,/**} wklx,

10139N/A deny /sys/fs/cgroup?*{,/**} wklx,

16554N/A deny /sys/fs?*{,/**} wklx,

17811N/A