diff --git a/common/pkg/apparmor/apparmor_linux_template.go b/common/pkg/apparmor/apparmor_linux_template.go index b8212542dd..48707521f6 100644 --- a/common/pkg/apparmor/apparmor_linux_template.go +++ b/common/pkg/apparmor/apparmor_linux_template.go @@ -21,6 +21,10 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) { # Allow signals from privileged profiles and from within the same profile signal (receive) peer=unconfined, signal (send,receive) peer={{.Name}}, + # Allow certain signals from OCI runtimes (podman, runc and crun) + signal (receive) peer={/usr/bin/,/usr/sbin/,}runc, + signal (receive) peer={/usr/bin/,/usr/sbin/,}crun*, + signal (receive) set=(int, quit, kill, term) peer={/usr/bin/,/usr/sbin/,}podman, {{end}} deny @{PROC}/* w, # deny write for all files directly in /proc (not in a subdir)