Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

lxd: Add support for apparmor unconfined profile mode #12713

Merged
merged 3 commits into from
Jan 18, 2024
Merged

lxd: Add support for apparmor unconfined profile mode #12713

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
be930d7
lxd/sys: handle apparmor unconfined profile mode appropriately
alexmurray Jan 9, 2024
148876f
lxd/apparmor: allow confined services to receive required signals
alexmurray Jan 9, 2024
e6901cd
lxd/sys: add comment clarifying AppArmor unconfined profile mode
alexmurray Jan 9, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion lxd/apparmor/archive.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ profile "{{.name}}" {
{{ .backupsPath }}/** rw,
{{ .imagesPath }}/** r,

signal (receive) set=("term") peer=unconfined,
signal (receive) set=("term"),
tomponline marked this conversation as resolved.
Show resolved Hide resolved

# Capabilities
capability chown,
Expand Down
3 changes: 3 additions & 0 deletions lxd/apparmor/network_dnsmasq.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,9 @@ profile "{{ .name }}" flags=(attach_disconnected,mediate_deleted) {
{{ .varPath }}/networks/{{ .networkName }}/dnsmasq.leases rw,
{{ .varPath }}/networks/{{ .networkName }}/dnsmasq.raw r,

# Allow to restart dnsmasq
signal (receive) set=("hup","kill"),

# Logging path
{{ .logPath }}/dnsmasq.{{ .networkName }}.log rw,

Expand Down
11 changes: 9 additions & 2 deletions lxd/sys/apparmor.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,9 +71,16 @@ func (s *OS) initAppArmor() []cluster.Warning {

/* Detect AppArmor confinment */
profile := util.AppArmorProfile()
if profile != "unconfined" && profile != "" {
/* if AppArmor is enabled on the system but there is no profile then
the application has the profile name "unconfined", or if AppArmor
is not supported then the label will be empty and finally newer
AppArmor releases support a profile mode "unconfined" where an
application can have a profile defined for it which effectively
is equivalent to the traditional "unconfined" label - in this case
the label will have the suffix " (unconfined)" */
if profile != "unconfined" && profile != "" && !strings.HasSuffix(profile, "(unconfined)") {
tomponline marked this conversation as resolved.
Show resolved Hide resolved
if s.AppArmorAvailable {
logger.Warnf("Per-container AppArmor profiles are disabled because LXD is already protected by AppArmor")
logger.Warnf("Per-container AppArmor profiles are disabled because LXD is already protected by AppArmor via profile %q", profile)
tomponline marked this conversation as resolved.
Show resolved Hide resolved
}

s.AppArmorConfined = true
Expand Down
Loading