From c49bc1f176f0f49764f92db7f63e68037a0c0f18 Mon Sep 17 00:00:00 2001 From: Sascha Grunert Date: Fri, 24 Jan 2020 15:33:34 +0100 Subject: apparmor: allow receiving of signals from 'podman kill' In newer kernels, AppArmor will reject attempts to send signals to a container because the signal originated from outside of that AppArmor profile. Correct this by allowing all unconfined signals to be received. Signed-off-by: Sascha Grunert --- pkg/apparmor/apparmor_linux_template.go | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'pkg/apparmor') diff --git a/pkg/apparmor/apparmor_linux_template.go b/pkg/apparmor/apparmor_linux_template.go index 163ba3792..8d9a92ef7 100644 --- a/pkg/apparmor/apparmor_linux_template.go +++ b/pkg/apparmor/apparmor_linux_template.go @@ -17,6 +17,12 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) { file, umount, +{{if ge .Version 208096}} + # Allow signals from privileged profiles and from within the same profile + signal (receive) peer=unconfined, + signal (send,receive) peer={{.Name}}, +{{end}} + deny @{PROC}/* w, # deny write for all files directly in /proc (not in a subdir) # deny write to files not in /proc//** or /proc/sys/** deny @{PROC}/{[^1-9],[^1-9][^0-9],[^1-9s][^0-9y][^0-9s],[^1-9][^0-9][^0-9][^0-9]*}/** w, -- cgit v1.2.3-54-g00ecf