From c11493737b4a5ffd59d635650f3a0d45f220ad2b Mon Sep 17 00:00:00 2001 From: Aleksa Sarai Date: Sun, 8 Apr 2018 20:21:30 +1000 Subject: [PATCH] apparmor: allow receiving of signals from 'docker kill' In newer kernels, AppArmor will reject attempts to send signals to a container because the signal originated from outside of that AppArmor profile. Correct this by allowing all unconfined signals to be received. SUSE-Bug: bsc#1073877 Signed-off-by: Goldwyn Rodrigues Signed-off-by: Aleksa Sarai --- components/engine/profiles/apparmor/template.go | 1 + 1 file changed, 1 insertion(+) diff --git a/components/engine/profiles/apparmor/template.go b/components/engine/profiles/apparmor/template.go index c5ea4584de6b..4830ac440645 100644 --- a/components/engine/profiles/apparmor/template.go +++ b/components/engine/profiles/apparmor/template.go @@ -17,6 +17,7 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) { capability, file, umount, + signal (receive) peer=unconfined, deny @{PROC}/* w, # deny write for all files directly in /proc (not in a subdir) # deny write to files not in /proc//** or /proc/sys/** -- 2.16.3