diff options
| author | OpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com> | 2020-01-28 10:30:57 -0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-01-28 10:30:57 -0800 |
| commit | 3426c34b77c9da54af85331d615e2111e152c499 (patch) | |
| tree | b8d148589e7549fe06400946181bba5a250d45ba | |
| parent | 6cb0f85933ec08995198f4384733f596b2e20cf5 (diff) | |
| parent | c49bc1f176f0f49764f92db7f63e68037a0c0f18 (diff) | |
| download | podman-3426c34b77c9da54af85331d615e2111e152c499.tar.gz podman-3426c34b77c9da54af85331d615e2111e152c499.tar.bz2 podman-3426c34b77c9da54af85331d615e2111e152c499.zip | |
Merge pull request #4964 from openSUSE/apparmor-signals
apparmor: allow receiving of signals from 'podman kill'
| -rw-r--r-- | pkg/apparmor/apparmor_linux_template.go | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/pkg/apparmor/apparmor_linux_template.go b/pkg/apparmor/apparmor_linux_template.go index 163ba3792..8d9a92ef7 100644 --- a/pkg/apparmor/apparmor_linux_template.go +++ b/pkg/apparmor/apparmor_linux_template.go @@ -17,6 +17,12 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) { file, umount, +{{if ge .Version 208096}} + # Allow signals from privileged profiles and from within the same profile + signal (receive) peer=unconfined, + signal (send,receive) peer={{.Name}}, +{{end}} + deny @{PROC}/* w, # deny write for all files directly in /proc (not in a subdir) # deny write to files not in /proc/<number>/** or /proc/sys/** deny @{PROC}/{[^1-9],[^1-9][^0-9],[^1-9s][^0-9y][^0-9s],[^1-9][^0-9][^0-9][^0-9]*}/** w, |