config/apparmor/abstractions/container-base.in

   1   network,
   2   capability,
   3   file,
   4   umount,
   5
   6   # dbus, signal, ptrace and unix are only supported by recent apparmor
   7   # versions. Comment them if the apparmor parser doesn't recognize them.
   8
   9   # This also needs additional rules to reach outside of the container via
  10   # DBus, so just let all of DBus within the container.
  11   dbus,
  12
  13   # Allow us to receive signals from anywhere. Note: if per-container profiles
  14   # are supported, for container isolation this should be changed to something
  15   # like:
  16   #   signal (receive) peer=unconfined,
  17   #   signal (receive) peer=/usr/bin/lxc-start,
  18   signal (receive),
  19
  20   # Allow us to send signals to ourselves
  21   signal peer=@{profile_name},
  22
  23   # Allow other processes to read our /proc entries, futexes, perf tracing and
  24   # kcmp for now (they will need 'read' in the first place). Administrators can
  25   # override with:
  26   #   deny ptrace (readby) ...
  27   ptrace (readby),
  28
  29   # Allow other processes to trace us by default (they will need 'trace' in
  30   # the first place). Administrators can override with:
  31   #   deny ptrace (tracedby) ...
  32   ptrace (tracedby),
  33
  34   # Allow us to ptrace ourselves
  35   ptrace peer=@{profile_name},
  36
  37   # Allow receive via unix sockets from anywhere. Note: if per-container
  38   # profiles are supported, for container isolation this should be changed to
  39   # something like:
  40   #   unix (receive) peer=(label=unconfined),
  41   unix (receive),
  42
  43   # Allow all unix in the container
  44   unix peer=(label=@{profile_name}),
  45
  46   # ignore DENIED message on / remount
  47   deny mount options=(ro, remount) -> /,
  48   deny mount options=(ro, remount, silent) -> /,
  49
  50   # allow tmpfs mounts everywhere
  51   mount fstype=tmpfs,
  52
  53   # allow hugetlbfs mounts everywhere
  54   mount fstype=hugetlbfs,
  55
  56   # allow mqueue mounts everywhere
  57   mount fstype=mqueue,
  58
  59   # allow fuse mounts everywhere
  60   mount fstype=fuse,
  61   mount fstype=fuse.*,
  62
  63   # deny access under /proc/bus to avoid e.g. messing with pci devices directly
  64   deny @{PROC}/bus/** wklx,
  65
  66   # deny writes in /proc/sys/fs but allow binfmt_misc to be mounted
  67   mount fstype=binfmt_misc -> /proc/sys/fs/binfmt_misc/,
  68   deny @{PROC}/sys/fs/** wklx,
  69
  70   # allow efivars to be mounted, writing to it will be blocked though
  71   mount fstype=efivarfs -> /sys/firmware/efi/efivars/,
  72
  73   # block some other dangerous paths
  74   deny @{PROC}/kcore rwklx,
  75   deny @{PROC}/sysrq-trigger rwklx,
  76
  77   # deny writes in /sys except for /sys/fs/cgroup, also allow
  78   # fusectl, securityfs and debugfs to be mounted there (read-only)
  79   mount fstype=fusectl -> /sys/fs/fuse/connections/,
  80   mount fstype=securityfs -> /sys/kernel/security/,
  81   mount fstype=debugfs -> /sys/kernel/debug/,
  82   deny mount fstype=debugfs -> /var/lib/ureadahead/debugfs/,
  83   mount fstype=proc -> /proc/,
  84   mount fstype=sysfs -> /sys/,
  85   mount options=(rw, nosuid, nodev, noexec, remount) -> /sys/,
  86   deny /sys/firmware/efi/efivars/** rwklx,
  87   deny /sys/kernel/security/** rwklx,
  88   mount options=(ro, nosuid, nodev, noexec, remount, strictatime) -> /sys/fs/cgroup/,
  89
  90   # deny reads from debugfs
  91   deny /sys/kernel/debug/{,**} rwklx,
  92
  93   # allow paths to be made slave, shared, private or unbindable
  94   # FIXME: This currently doesn't work due to the apparmor parser treating those as allowing all mounts.
  95 #  mount options=(rw,make-slave) -> **,
  96 #  mount options=(rw,make-rslave) -> **,
  97 #  mount options=(rw,make-shared) -> **,
  98 #  mount options=(rw,make-rshared) -> **,
  99 #  mount options=(rw,make-private) -> **,
 100 #  mount options=(rw,make-rprivate) -> **,
 101 #  mount options=(rw,make-unbindable) -> **,
 102 #  mount options=(rw,make-runbindable) -> **,
 103
 104   # allow bind-mounts of anything except /proc, /sys and /dev
 105   mount options=(rw,bind) /[^spd]*{,/**},
 106   mount options=(rw,bind) /d[^e]*{,/**},
 107   mount options=(rw,bind) /de[^v]*{,/**},
 108   mount options=(rw,bind) /dev/.[^l]*{,/**},
 109   mount options=(rw,bind) /dev/.l[^x]*{,/**},
 110   mount options=(rw,bind) /dev/.lx[^c]*{,/**},
 111   mount options=(rw,bind) /dev/.lxc?*{,/**},
 112   mount options=(rw,bind) /dev/[^.]*{,/**},
 113   mount options=(rw,bind) /dev?*{,/**},
 114   mount options=(rw,bind) /p[^r]*{,/**},
 115   mount options=(rw,bind) /pr[^o]*{,/**},
 116   mount options=(rw,bind) /pro[^c]*{,/**},
 117   mount options=(rw,bind) /proc?*{,/**},
 118   mount options=(rw,bind) /s[^y]*{,/**},
 119   mount options=(rw,bind) /sy[^s]*{,/**},
 120   mount options=(rw,bind) /sys?*{,/**},
 121
 122   # allow various ro-bind-*re*-mounts
 123   mount options=(ro,remount,bind),
 124   mount options=(ro,remount,bind,nosuid),
 125   mount options=(ro,remount,bind,noexec),
 126   mount options=(ro,remount,bind,nodev),
 127   mount options=(ro,remount,bind,nosuid,noexec),
 128   mount options=(ro,remount,bind,noexec,nodev),
 129   mount options=(ro,remount,bind,nodev,nosuid),
 130   mount options=(ro,remount,bind,nosuid,noexec,nodev),
 131
 132   # allow moving mounts except for /proc, /sys and /dev
 133   mount options=(rw,move) /[^spd]*{,/**},
 134   mount options=(rw,move) /d[^e]*{,/**},
 135   mount options=(rw,move) /de[^v]*{,/**},
 136   mount options=(rw,move) /dev/.[^l]*{,/**},
 137   mount options=(rw,move) /dev/.l[^x]*{,/**},
 138   mount options=(rw,move) /dev/.lx[^c]*{,/**},
 139   mount options=(rw,move) /dev/.lxc?*{,/**},
 140   mount options=(rw,move) /dev/[^.]*{,/**},
 141   mount options=(rw,move) /dev?*{,/**},
 142   mount options=(rw,move) /p[^r]*{,/**},
 143   mount options=(rw,move) /pr[^o]*{,/**},
 144   mount options=(rw,move) /pro[^c]*{,/**},
 145   mount options=(rw,move) /proc?*{,/**},
 146   mount options=(rw,move) /s[^y]*{,/**},
 147   mount options=(rw,move) /sy[^s]*{,/**},
 148   mount options=(rw,move) /sys?*{,/**},