Accepting request 756074 from home:cyphar:docker

- Add backport of https://github.com/docker/docker/pull/39121. bsc#1122469
  + bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch

OBS-URL: https://build.opensuse.org/request/show/756074
OBS-URL: https://build.opensuse.org/package/show/Virtualization:containers/docker?expand=0&rev=333

bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch

@@ -0,0 +1,40 @@
+From cb676052272ed4f6f3b901dbc21510fabf742860 Mon Sep 17 00:00:00 2001
+From: Goldwyn Rodrigues <rgoldwyn@suse.com>
+Date: Mon, 22 Apr 2019 09:08:28 -0500
+Subject: [PATCH] apparmor: allow readby and tracedby
+
+Fixes audit errors such as:
+
+type=AVC msg=audit(1550236803.810:143):
+apparmor="DENIED" operation="ptrace" profile="docker-default"
+pid=3181 comm="ps" requested_mask="readby" denied_mask="readby"
+peer="docker-default"
+
+audit(1550236375.918:3): apparmor="DENIED" operation="ptrace"
+profile="docker-default" pid=2267 comm="ps"
+requested_mask="tracedby" denied_mask="tracedby"
+peer="docker-default"
+
+SUSE-Bugs: bsc#1122469
+Signed-off-by: Goldwyn Rodrigues <rgoldwyn@suse.com>
+Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
+---
+ components/engine/profiles/apparmor/template.go | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/components/engine/profiles/apparmor/template.go b/components/engine/profiles/apparmor/template.go
+index 400b3bd50a11..d8db0ee2fb36 100644
+--- a/components/engine/profiles/apparmor/template.go
++++ b/components/engine/profiles/apparmor/template.go
+@@ -44,7 +44,7 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) {
+ 
+ {{if ge .Version 208095}}
+   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
+-  ptrace (trace,read) peer={{.Name}},
++  ptrace (trace,read,tracedby,readby) peer={{.Name}},
+ {{end}}
+ }
+ `
+-- 
+2.24.0
+

docker.changes

@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Thu Dec 12 13:27:21 UTC 2019 - Aleksa Sarai <asarai@suse.com>
+
+- Add backport of https://github.com/docker/docker/pull/39121. bsc#1122469
+  + bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
+
 -------------------------------------------------------------------
 Wed Dec 11 23:55:40 UTC 2019 - Aleksa Sarai <asarai@suse.com>
 

docker.spec

@@ -77,10 +77,12 @@ Source10:       docker-daemon.json
 # branch in http://github.com/suse/docker.mirror.
 Patch200:       secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
 Patch201:       secrets-0002-SUSE-implement-SUSE-container-secrets.patch
+# SUSE-ISSUE: Revert of https://github.com/docker/docker/pull/37907.
+Patch300:       packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
 # SUSE-BACKPORT: Backport of https://github.com/docker/docker/pull/37353. bsc#1099277
 Patch401:       bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
-# SUSE-ISSUE: Revert of https://github.com/docker/docker/pull/37907.
+# SUSE-BACKPORT: Backport of https://github.com/docker/docker/pull/39121. bsc#1122469
-Patch402:       packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
+Patch402:       bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
 # SUSE-FEATURE: Add support to mirror inofficial/private registries
 #               (https://github.com/docker/docker/pull/34319)
 Patch500:       private-registry-0001-Add-private-registry-mirror-support.patch
@@ -255,9 +257,11 @@ docker container runtime configuration for kubeadm
 %patch200 -p1
 %patch201 -p1
 %endif
+# revert upstream
+%patch300 -p1
 # bsc#1099277
 %patch401 -p1
-# revert upstream
+# bsc#1122469
 %patch402 -p1
 %if "%flavour" == "kubic"
 # PATCH-SUSE: Mirror patch.