6994271ca4
Previously, Podman would print an error if you tried to run a container
with an AppArmor profile as a non-root user, e.g.
$ podman run --security-opt apparmor=my-profile ...
Error: Apparmor profile "my-profile" specified, but Apparmor is not
enabled on this system
In fact, the only thing that Podman needs root privileges for is reading
/sys/kernel/security/apparmor/profiles to see if the profile is already
loaded, which isn't strictly necessary.
This commit removes the 'IsLoaded()' check that occurs when you try to
specify an AppArmor profile as a non-root user, as well as the other
checks in pkg/apparmor/ for whether the program is running as UID 0. The
check for whether the AppArmor profile is loaded should now be deferred
to the container runtime at the point where it writes to either
/proc/self/attr/exec or /proc/self/attr/apparmor/exec, since the write
should fail if the profile is not loaded.
Closes #958.
Signed-off-by: kernelmethod <17100608+kernelmethod@users.noreply.github.com>
|
||
|---|---|---|
| .. | ||
| .github | ||
| cmd/seccomp | ||
| docs | ||
| libimage | ||
| libnetwork | ||
| logos | ||
| pkg | ||
| tests | ||
| tools | ||
| vendor | ||
| version | ||
| .cirrus.yml | ||
| .gitignore | ||
| .golangci.yml | ||
| CODE-OF-CONDUCT.md | ||
| CONTRIBUTING.md | ||
| LICENSE | ||
| Makefile | ||
| OWNERS | ||
| README.md | ||
| SECURITY.md | ||
| go.mod | ||
| go.sum | ||
README.md
containers/common
Location for shared common files and common go code to manage those files in github.com/containers repos.
The common files to one or more projects in the containers group will be kept in this repository.
It will be up to the individual projects to include the files from this repository.
seccomp
The seccomp package in pkg/seccomp is a set of Go libraries
used by container runtimes to generate and load seccomp mappings into the
kernel.
seccomp (short for secure computing mode) is a BPF based syscall filter language and present a more conventional function-call based filtering interface that should be familiar to, and easily adopted by, application developers.
Building the seccomp.json file
The make target make seccomp.json generates the seccomp.json file, which
contains the allowed list of syscalls that can be used by container runtime
engines like CRI-O, Buildah, Podman and
Docker, and container runtimes like OCI Runc to control the
syscalls available to containers.
Supported build tags
pkg/apparmor:apparmor,linuxpkg/seccomp:seccomppkg/config:darwin,remote,linux,systemdpkg/sysinfo:linux,solaris,windows,cgopkg/cgroupv2:linux
Contributing
When developing this library, please use make (or make … BUILDTAGS=…) to
take advantage of the tests and validation.
Contact
- IRC: #containers on freenode.net