summaryrefslogtreecommitdiff
path: root/pkg/apparmor
diff options
context:
space:
mode:
authorSascha Grunert <sgrunert@suse.com>2020-01-24 15:33:34 +0100
committerSascha Grunert <sgrunert@suse.com>2020-01-24 15:34:47 +0100
commitc49bc1f176f0f49764f92db7f63e68037a0c0f18 (patch)
treebe931fdda8df63ebb6327793ab20f6b28a1860f2 /pkg/apparmor
parent5bad873c4cd9fab9112e1d84ba376d47073cc8bb (diff)
downloadpodman-c49bc1f176f0f49764f92db7f63e68037a0c0f18.tar.gz
podman-c49bc1f176f0f49764f92db7f63e68037a0c0f18.tar.bz2
podman-c49bc1f176f0f49764f92db7f63e68037a0c0f18.zip
apparmor: allow receiving of signals from 'podman kill'
In newer kernels, AppArmor will reject attempts to send signals to a container because the signal originated from outside of that AppArmor profile. Correct this by allowing all unconfined signals to be received. Signed-off-by: Sascha Grunert <sgrunert@suse.com>
Diffstat (limited to 'pkg/apparmor')
-rw-r--r--pkg/apparmor/apparmor_linux_template.go6
1 files changed, 6 insertions, 0 deletions
diff --git a/pkg/apparmor/apparmor_linux_template.go b/pkg/apparmor/apparmor_linux_template.go
index 163ba3792..8d9a92ef7 100644
--- a/pkg/apparmor/apparmor_linux_template.go
+++ b/pkg/apparmor/apparmor_linux_template.go
@@ -17,6 +17,12 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) {
file,
umount,
+{{if ge .Version 208096}}
+ # Allow signals from privileged profiles and from within the same profile
+ signal (receive) peer=unconfined,
+ signal (send,receive) peer={{.Name}},
+{{end}}
+
deny @{PROC}/* w, # deny write for all files directly in /proc (not in a subdir)
# deny write to files not in /proc/<number>/** or /proc/sys/**
deny @{PROC}/{[^1-9],[^1-9][^0-9],[^1-9s][^0-9y][^0-9s],[^1-9][^0-9][^0-9][^0-9]*}/** w,