7e7d9a111a
- Fix up the AppArmor 'docker kill' patch to work on older AppArmor versions. boo#1089732 * bsc1073877-0001-apparmor-allow-receiving-of-signals-from-docker-kill.patch OBS-URL: https://build.opensuse.org/request/show/598526 OBS-URL: https://build.opensuse.org/package/show/Virtualization:containers/docker?expand=0&rev=243
35 lines
1.3 KiB
Diff
35 lines
1.3 KiB
Diff
From fb59d17b2617ebee34f91786428f63571a19bb74 Mon Sep 17 00:00:00 2001
|
|
From: Aleksa Sarai <asarai@suse.de>
|
|
Date: Sun, 8 Apr 2018 20:21:30 +1000
|
|
Subject: [PATCH] apparmor: allow receiving of signals from 'docker kill'
|
|
|
|
In newer kernels, AppArmor will reject attempts to send signals to a
|
|
container because the signal originated from outside of that AppArmor
|
|
profile. Correct this by allowing all unconfined signals to be received.
|
|
|
|
SUSE-Bugs: bsc#1073877 boo#1089732
|
|
Signed-off-by: Goldwyn Rodrigues <rgoldwyn@suse.com>
|
|
Signed-off-by: Aleksa Sarai <asarai@suse.de>
|
|
---
|
|
components/engine/profiles/apparmor/template.go | 4 ++++
|
|
1 file changed, 4 insertions(+)
|
|
|
|
diff --git a/components/engine/profiles/apparmor/template.go b/components/engine/profiles/apparmor/template.go
|
|
index c5ea4584de6b..47c1b0659a15 100644
|
|
--- a/components/engine/profiles/apparmor/template.go
|
|
+++ b/components/engine/profiles/apparmor/template.go
|
|
@@ -17,6 +17,10 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) {
|
|
capability,
|
|
file,
|
|
umount,
|
|
+{{if ge .Version 208096}}
|
|
+{{/* Allow 'docker kill' to actually send signals to container processes. */}}
|
|
+ signal (receive) peer=unconfined,
|
|
+{{end}}
|
|
|
|
deny @{PROC}/* w, # deny write for all files directly in /proc (not in a subdir)
|
|
# deny write to files not in /proc/<number>/** or /proc/sys/**
|
|
--
|
|
2.16.3
|
|
|