mirror of
https://git.proxmox.com/git/mirror_lxc
synced 2025-08-04 21:21:36 +00:00
198b363fff
This uses the generate-apparmor-rules.py script I sent out some time ago to auto-generate apparmor rules based on a higher level set of block/allow rules. Add apparmor policy testcase to make sure that some of the paths we expect to be denied (and allowed) write access to are in fact in effect in the final policy. With this policy, libvirt in a container is able to start its default network, which previously it could not. v2: address feedback from stgraber put lxc-generate-aa-rules.py into EXTRA_DIST add lxc-test-apparmor, container-base and container-rules to .gitignore take lxc-test-apparmor out of EXTRA_DIST make lxc-generate-aa-rules.py pep8-compliant don't automatically generate apparmor rules This is only bc we can't be guaranteed that python3 will be available. Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by: Stéphane Graber <stgraber@ubuntu.com>
89 lines
3.0 KiB
Plaintext
89 lines
3.0 KiB
Plaintext
network,
|
|
capability,
|
|
file,
|
|
umount,
|
|
dbus,
|
|
|
|
# ignore DENIED message on / remount
|
|
deny mount options=(ro, remount) -> /,
|
|
|
|
# allow tmpfs mounts everywhere
|
|
mount fstype=tmpfs,
|
|
|
|
# allow mqueue mounts everywhere
|
|
mount fstype=mqueue,
|
|
|
|
# allow fuse mounts everywhere
|
|
mount fstype=fuse.*,
|
|
|
|
# allow bind mount of /lib/init/fstab for lxcguest
|
|
mount options=(rw, bind) /lib/init/fstab.lxc/ -> /lib/init/fstab/,
|
|
|
|
# deny writes in /proc/sys/fs but allow binfmt_misc to be mounted
|
|
mount fstype=binfmt_misc -> /proc/sys/fs/binfmt_misc/,
|
|
deny @{PROC}/sys/fs/** wklx,
|
|
|
|
# allow efivars to be mounted, writing to it will be blocked though
|
|
mount fstype=efivarfs -> /sys/firmware/efi/efivars/,
|
|
|
|
# block some other dangerous paths
|
|
deny @{PROC}/sysrq-trigger rwklx,
|
|
deny @{PROC}/mem rwklx,
|
|
deny @{PROC}/kmem rwklx,
|
|
|
|
# deny writes in /sys except for /sys/fs/cgroup, also allow
|
|
# fusectl, securityfs and debugfs to be mounted there (read-only)
|
|
mount fstype=fusectl -> /sys/fs/fuse/connections/,
|
|
mount fstype=securityfs -> /sys/kernel/security/,
|
|
mount fstype=debugfs -> /sys/kernel/debug/,
|
|
deny mount fstype=debugfs -> /var/lib/ureadahead/debugfs/,
|
|
mount fstype=proc -> /proc/,
|
|
mount fstype=sysfs -> /sys/,
|
|
deny /sys/firmware/efi/efivars/** rwklx,
|
|
deny /sys/kernel/security/** rwklx,
|
|
mount options=(move) /sys/fs/cgroup/cgmanager/ -> /sys/fs/cgroup/cgmanager.lower/,
|
|
|
|
# generated by: lxc-generate-aa-rules.py container-rules.base
|
|
deny /proc/sys/kernel/[^s]*{,/**} wklx,
|
|
deny /proc/sys/kernel/s[^h]*{,/**} wklx,
|
|
deny /proc/sys/kernel/sh[^m]*{,/**} wklx,
|
|
deny /proc/sys/kernel/shm*/** wklx,
|
|
deny /sys/[^fdc]*{,/**} wklx,
|
|
deny /sys/c[^l]*{,/**} wklx,
|
|
deny /sys/cl[^a]*{,/**} wklx,
|
|
deny /sys/cla[^s]*{,/**} wklx,
|
|
deny /sys/clas[^s]*{,/**} wklx,
|
|
deny /sys/class/[^n]*{,/**} wklx,
|
|
deny /sys/class/n[^e]*{,/**} wklx,
|
|
deny /sys/class/ne[^t]*{,/**} wklx,
|
|
deny /sys/class/net?*{,/**} wklx,
|
|
deny /sys/class?*{,/**} wklx,
|
|
deny /sys/d[^e]*{,/**} wklx,
|
|
deny /sys/de[^v]*{,/**} wklx,
|
|
deny /sys/dev[^i]*{,/**} wklx,
|
|
deny /sys/devi[^c]*{,/**} wklx,
|
|
deny /sys/devic[^e]*{,/**} wklx,
|
|
deny /sys/device[^s]*{,/**} wklx,
|
|
deny /sys/devices/[^v]*{,/**} wklx,
|
|
deny /sys/devices/v[^i]*{,/**} wklx,
|
|
deny /sys/devices/vi[^r]*{,/**} wklx,
|
|
deny /sys/devices/vir[^t]*{,/**} wklx,
|
|
deny /sys/devices/virt[^u]*{,/**} wklx,
|
|
deny /sys/devices/virtu[^a]*{,/**} wklx,
|
|
deny /sys/devices/virtua[^l]*{,/**} wklx,
|
|
deny /sys/devices/virtual/[^n]*{,/**} wklx,
|
|
deny /sys/devices/virtual/n[^e]*{,/**} wklx,
|
|
deny /sys/devices/virtual/ne[^t]*{,/**} wklx,
|
|
deny /sys/devices/virtual/net?*{,/**} wklx,
|
|
deny /sys/devices/virtual?*{,/**} wklx,
|
|
deny /sys/devices?*{,/**} wklx,
|
|
deny /sys/f[^s]*{,/**} wklx,
|
|
deny /sys/fs/[^c]*{,/**} wklx,
|
|
deny /sys/fs/c[^g]*{,/**} wklx,
|
|
deny /sys/fs/cg[^r]*{,/**} wklx,
|
|
deny /sys/fs/cgr[^o]*{,/**} wklx,
|
|
deny /sys/fs/cgro[^u]*{,/**} wklx,
|
|
deny /sys/fs/cgrou[^p]*{,/**} wklx,
|
|
deny /sys/fs/cgroup?*{,/**} wklx,
|
|
deny /sys/fs?*{,/**} wklx,
|