gitee.com/mysnapcore/mysnapd@v0.1.0/interfaces/builtin/docker_support.go (about) 1 // -*- Mode: Go; indent-tabs-mode: t -*- 2 3 /* 4 * Copyright (C) 2016-2018 Canonical Ltd 5 * 6 * This program is free software: you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License version 3 as 8 * published by the Free Software Foundation. 9 * 10 * This program is distributed in the hope that it will be useful, 11 * but WITHOUT ANY WARRANTY; without even the implied warranty of 12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 * GNU General Public License for more details. 14 * 15 * You should have received a copy of the GNU General Public License 16 * along with this program. If not, see <http://www.gnu.org/licenses/>. 17 * 18 */ 19 20 package builtin 21 22 import ( 23 "fmt" 24 25 "gitee.com/mysnapcore/mysnapd/interfaces" 26 "gitee.com/mysnapcore/mysnapd/interfaces/apparmor" 27 "gitee.com/mysnapcore/mysnapd/interfaces/kmod" 28 "gitee.com/mysnapcore/mysnapd/interfaces/seccomp" 29 "gitee.com/mysnapcore/mysnapd/release" 30 "gitee.com/mysnapcore/mysnapd/snap" 31 ) 32 33 const dockerSupportSummary = `allows operating as the Docker daemon` 34 35 const dockerSupportBaseDeclarationPlugs = ` 36 docker-support: 37 allow-installation: false 38 deny-auto-connection: true 39 ` 40 41 const dockerSupportBaseDeclarationSlots = ` 42 docker-support: 43 allow-installation: 44 slot-snap-type: 45 - core 46 deny-auto-connection: true 47 ` 48 49 const dockerSupportConnectedPlugAppArmorCore = ` 50 # These accesses are necessary for Ubuntu Core 16 and 18, likely due to the 51 # version of apparmor or the kernel which doesn't resolve the upper layer of an 52 # overlayfs mount correctly the accesses show up as runc trying to read from 53 # /system-data/var/snap/docker/common/var-lib-docker/overlay2/$SHA/diff/ 54 /system-data/var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/common/{,**} rwl, 55 /system-data/var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/@{SNAP_REVISION}/{,**} rwl, 56 ` 57 58 const dockerSupportConnectedPlugAppArmor = ` 59 # Description: allow operating as the Docker daemon/containerd. This policy is 60 # intentionally not restrictive and is here to help guard against programming 61 # errors and not for security confinement. The Docker daemon by design requires 62 # extensive access to the system and cannot be effectively confined against 63 # malicious activity. 64 65 #include <abstractions/dbus-strict> 66 67 # Allow sockets/etc for docker 68 /{,var/}run/docker.sock rw, 69 /{,var/}run/docker/ rw, 70 /{,var/}run/docker/** mrwklix, 71 /{,var/}run/runc/ rw, 72 /{,var/}run/runc/** mrwklix, 73 74 # Allow sockets/etc for containerd 75 /{,var/}run/containerd/{,s/,runc/,runc/k8s.io/,runc/k8s.io/*/} rw, 76 /{,var/}run/containerd/runc/k8s.io/*/** rwk, 77 /{,var/}run/containerd/{io.containerd*/,io.containerd*/k8s.io/,io.containerd*/k8s.io/*/} rw, 78 /{,var/}run/containerd/io.containerd*/*/** rwk, 79 /{,var/}run/containerd/s/** rwk, 80 81 # Limit ipam-state to k8s 82 /run/ipam-state/k8s-** rw, 83 /run/ipam-state/k8s-*/lock k, 84 85 # Socket for docker-containerd-shim 86 unix (bind,listen) type=stream addr="@/containerd-shim/**.sock\x00", 87 88 /{,var/}run/mount/utab r, 89 90 # Wide read access to /proc, but somewhat limited writes for now 91 @{PROC}/ r, 92 @{PROC}/** r, 93 @{PROC}/[0-9]*/attr/{,apparmor/}exec w, 94 @{PROC}/[0-9]*/oom_score_adj w, 95 96 # Limited read access to specific bits of /sys 97 /sys/kernel/mm/hugepages/ r, 98 /sys/kernel/mm/transparent_hugepage/{,**} r, 99 /sys/fs/cgroup/cpuset/cpuset.cpus r, 100 /sys/fs/cgroup/cpuset/cpuset.mems r, 101 /sys/module/apparmor/parameters/enabled r, 102 103 # Limit cgroup writes a bit (Docker uses a "docker" sub-group) 104 /sys/fs/cgroup/*/docker/ rw, 105 /sys/fs/cgroup/*/docker/** rw, 106 107 # Also allow cgroup writes to kubernetes pods 108 /sys/fs/cgroup/*/kubepods/ rw, 109 /sys/fs/cgroup/*/kubepods/** rw, 110 111 # containerd can also be configured to use the systemd cgroup driver via 112 # plugins.cri.systemd_cgroup = true which moves container processes into 113 # systemd-managed cgroups. This is now the recommended configuration since it 114 # provides a single cgroup manager (systemd) in an effort to achieve consistent 115 # views of resources. 116 /sys/fs/cgroup/*/systemd/{,system.slice/} rw, # create missing dirs 117 /sys/fs/cgroup/*/systemd/system.slice/** r, 118 /sys/fs/cgroup/*/systemd/system.slice/cgroup.procs w, 119 120 # Allow tracing ourself (especially the "runc" process we create) 121 ptrace (trace) peer=@{profile_name}, 122 123 # Docker needs a lot of caps, but limits them in the app container 124 capability, 125 126 # Docker does all kinds of mounts all over the filesystem 127 /dev/mapper/control rw, 128 /dev/mapper/docker* rw, 129 /dev/loop-control r, 130 /dev/loop[0-9]* rw, 131 /sys/devices/virtual/block/dm-[0-9]*/** r, 132 mount, 133 umount, 134 135 # After doing a pivot_root using <graph-dir>/<container-fs>/.pivot_rootNNNNNN, 136 # Docker removes the leftover /.pivot_rootNNNNNN directory (which is now 137 # relative to "/" instead of "<graph-dir>/<container-fs>" thanks to pivot_root) 138 pivot_root, 139 /.pivot_root[0-9]*/ rw, 140 141 # file descriptors (/proc/NNN/fd/X) 142 # file descriptors in the container show up here due to attach_disconnected 143 /[0-9]* rw, 144 145 # Docker needs to be able to create and load the profile it applies to 146 # containers ("docker-default") 147 /{,usr/}sbin/apparmor_parser ixr, 148 /etc/apparmor.d/cache/ r, # apparmor 2.12 and below 149 /etc/apparmor.d/cache/.features r, 150 /etc/apparmor.d/{,cache/}docker* rw, 151 /var/cache/apparmor/{,*/} r, # apparmor 2.13 and higher 152 /var/cache/apparmor/*/.features r, 153 /var/cache/apparmor/*/docker* rw, 154 /etc/apparmor.d/tunables/{,**} r, 155 /etc/apparmor.d/abstractions/{,**} r, 156 /etc/apparmor/parser.conf r, 157 /etc/apparmor/subdomain.conf r, 158 /sys/kernel/security/apparmor/.replace rw, 159 /sys/kernel/security/apparmor/{,**} r, 160 161 # use 'privileged-containers: true' to support --security-opts 162 163 # defaults for docker-default 164 # Unfortunately, the docker snap is currently (by design?) setup to have both 165 # the privileged and unprivileged variant of the docker-support interface 166 # connected which means we have rules that are compatible to allow both 167 # transitioning to docker-default profile here AAAAAAND transitioning to any 168 # other profile below in the privileged snippet, BUUUUUUUT also need to be 169 # triply compatible with the injected compatibility snap-confine transition 170 # rules to temporarily support executing other snaps from devmode snaps. 171 # So we are left with writing out these extremely verbose regexps because AARE 172 # does not have a negative concept to exclude just the paths we want. 173 # See also https://bugs.launchpad.net/apparmor/+bug/1964853 and 174 # https://bugs.launchpad.net/apparmor/+bug/1964854 for more details on the 175 # AppArmor parser side of things. 176 # TODO: When we drop support for executing other snaps from devmode snaps (or 177 # when the AppArmor parser bugs are fixed) this can go back to the much simpler 178 # rule: 179 # change_profile unsafe /** -> docker-default, 180 # but until then we are stuck with: 181 change_profile unsafe /[^s]** -> docker-default, 182 change_profile unsafe /s[^n]** -> docker-default, 183 change_profile unsafe /sn[^a]** -> docker-default, 184 change_profile unsafe /sna[^p]** -> docker-default, 185 change_profile unsafe /snap[^/]** -> docker-default, 186 change_profile unsafe /snap/[^sc]** -> docker-default, 187 change_profile unsafe /snap/{s[^n],c[^o]}** -> docker-default, 188 change_profile unsafe /snap/{sn[^a],co[^r]}** -> docker-default, 189 change_profile unsafe /snap/{sna[^p],cor[^e]}** -> docker-default, 190 191 # branch for the /snap/core/... paths 192 change_profile unsafe /snap/core[^/]** -> docker-default, 193 change_profile unsafe /snap/core/*/[^u]** -> docker-default, 194 change_profile unsafe /snap/core/*/u[^s]** -> docker-default, 195 change_profile unsafe /snap/core/*/us[^r]** -> docker-default, 196 change_profile unsafe /snap/core/*/usr[^/]** -> docker-default, 197 change_profile unsafe /snap/core/*/usr/[^l]** -> docker-default, 198 change_profile unsafe /snap/core/*/usr/l[^i]** -> docker-default, 199 change_profile unsafe /snap/core/*/usr/li[^b]** -> docker-default, 200 change_profile unsafe /snap/core/*/usr/lib[^/]** -> docker-default, 201 change_profile unsafe /snap/core/*/usr/lib/[^s]** -> docker-default, 202 change_profile unsafe /snap/core/*/usr/lib/s[^n]** -> docker-default, 203 change_profile unsafe /snap/core/*/usr/lib/sn[^a]** -> docker-default, 204 change_profile unsafe /snap/core/*/usr/lib/sna[^p]** -> docker-default, 205 change_profile unsafe /snap/core/*/usr/lib/snap[^d]** -> docker-default, 206 change_profile unsafe /snap/core/*/usr/lib/snapd[^/]** -> docker-default, 207 change_profile unsafe /snap/core/*/usr/lib/snapd/[^s]** -> docker-default, 208 change_profile unsafe /snap/core/*/usr/lib/snapd/s[^n]** -> docker-default, 209 change_profile unsafe /snap/core/*/usr/lib/snapd/sn[^a]** -> docker-default, 210 change_profile unsafe /snap/core/*/usr/lib/snapd/sna[^p]** -> docker-default, 211 change_profile unsafe /snap/core/*/usr/lib/snapd/snap[^-]** -> docker-default, 212 change_profile unsafe /snap/core/*/usr/lib/snapd/snap-[^c]** -> docker-default, 213 change_profile unsafe /snap/core/*/usr/lib/snapd/snap-c[^o]** -> docker-default, 214 change_profile unsafe /snap/core/*/usr/lib/snapd/snap-co[^n]** -> docker-default, 215 change_profile unsafe /snap/core/*/usr/lib/snapd/snap-con[^f]** -> docker-default, 216 change_profile unsafe /snap/core/*/usr/lib/snapd/snap-conf[^i]** -> docker-default, 217 change_profile unsafe /snap/core/*/usr/lib/snapd/snap-confi[^n]** -> docker-default, 218 change_profile unsafe /snap/core/*/usr/lib/snapd/snap-confin[^e]** -> docker-default, 219 220 # branch for the /snap/snapd/... paths 221 change_profile unsafe /snap/snap[^d]** -> docker-default, 222 change_profile unsafe /snap/snapd[^/]** -> docker-default, 223 change_profile unsafe /snap/snapd/*/[^u]** -> docker-default, 224 change_profile unsafe /snap/snapd/*/u[^s]** -> docker-default, 225 change_profile unsafe /snap/snapd/*/us[^r]** -> docker-default, 226 change_profile unsafe /snap/snapd/*/usr[^/]** -> docker-default, 227 change_profile unsafe /snap/snapd/*/usr/[^l]** -> docker-default, 228 change_profile unsafe /snap/snapd/*/usr/l[^i]** -> docker-default, 229 change_profile unsafe /snap/snapd/*/usr/li[^b]** -> docker-default, 230 change_profile unsafe /snap/snapd/*/usr/lib[^/]** -> docker-default, 231 change_profile unsafe /snap/snapd/*/usr/lib/[^s]** -> docker-default, 232 change_profile unsafe /snap/snapd/*/usr/lib/s[^n]** -> docker-default, 233 change_profile unsafe /snap/snapd/*/usr/lib/sn[^a]** -> docker-default, 234 change_profile unsafe /snap/snapd/*/usr/lib/sna[^p]** -> docker-default, 235 change_profile unsafe /snap/snapd/*/usr/lib/snap[^d]** -> docker-default, 236 change_profile unsafe /snap/snapd/*/usr/lib/snapd[^/]** -> docker-default, 237 change_profile unsafe /snap/snapd/*/usr/lib/snapd/[^s]** -> docker-default, 238 change_profile unsafe /snap/snapd/*/usr/lib/snapd/s[^n]** -> docker-default, 239 change_profile unsafe /snap/snapd/*/usr/lib/snapd/sn[^a]** -> docker-default, 240 change_profile unsafe /snap/snapd/*/usr/lib/snapd/sna[^p]** -> docker-default, 241 change_profile unsafe /snap/snapd/*/usr/lib/snapd/snap[^-]** -> docker-default, 242 change_profile unsafe /snap/snapd/*/usr/lib/snapd/snap-[^c]** -> docker-default, 243 change_profile unsafe /snap/snapd/*/usr/lib/snapd/snap-c[^o]** -> docker-default, 244 change_profile unsafe /snap/snapd/*/usr/lib/snapd/snap-co[^n]** -> docker-default, 245 change_profile unsafe /snap/snapd/*/usr/lib/snapd/snap-con[^f]** -> docker-default, 246 change_profile unsafe /snap/snapd/*/usr/lib/snapd/snap-conf[^i]** -> docker-default, 247 change_profile unsafe /snap/snapd/*/usr/lib/snapd/snap-confi[^n]** -> docker-default, 248 change_profile unsafe /snap/snapd/*/usr/lib/snapd/snap-confin[^e]** -> docker-default, 249 250 251 # signal/tracing rules too 252 signal (send) peer=docker-default, 253 ptrace (read, trace) peer=docker-default, 254 255 256 # defaults for containerd 257 # TODO: When we drop support for executing other snaps from devmode snaps (or 258 # when the AppArmor parser bugs are fixed) this can go back to the much simpler 259 # rule: 260 # change_profile unsafe /** -> cri-containerd.apparmor.d, 261 # see above comment, we need this because we can't have nice things 262 change_profile unsafe /[^s]** -> cri-containerd.apparmor.d, 263 change_profile unsafe /s[^n]** -> cri-containerd.apparmor.d, 264 change_profile unsafe /sn[^a]** -> cri-containerd.apparmor.d, 265 change_profile unsafe /sna[^p]** -> cri-containerd.apparmor.d, 266 change_profile unsafe /snap[^/]** -> cri-containerd.apparmor.d, 267 change_profile unsafe /snap/[^sc]** -> cri-containerd.apparmor.d, 268 change_profile unsafe /snap/{s[^n],c[^o]}** -> cri-containerd.apparmor.d, 269 change_profile unsafe /snap/{sn[^a],co[^r]}** -> cri-containerd.apparmor.d, 270 change_profile unsafe /snap/{sna[^p],cor[^e]}** -> cri-containerd.apparmor.d, 271 272 # branch for the /snap/core/... paths 273 change_profile unsafe /snap/core[^/]** -> cri-containerd.apparmor.d, 274 change_profile unsafe /snap/core/*/[^u]** -> cri-containerd.apparmor.d, 275 change_profile unsafe /snap/core/*/u[^s]** -> cri-containerd.apparmor.d, 276 change_profile unsafe /snap/core/*/us[^r]** -> cri-containerd.apparmor.d, 277 change_profile unsafe /snap/core/*/usr[^/]** -> cri-containerd.apparmor.d, 278 change_profile unsafe /snap/core/*/usr/[^l]** -> cri-containerd.apparmor.d, 279 change_profile unsafe /snap/core/*/usr/l[^i]** -> cri-containerd.apparmor.d, 280 change_profile unsafe /snap/core/*/usr/li[^b]** -> cri-containerd.apparmor.d, 281 change_profile unsafe /snap/core/*/usr/lib[^/]** -> cri-containerd.apparmor.d, 282 change_profile unsafe /snap/core/*/usr/lib/[^s]** -> cri-containerd.apparmor.d, 283 change_profile unsafe /snap/core/*/usr/lib/s[^n]** -> cri-containerd.apparmor.d, 284 change_profile unsafe /snap/core/*/usr/lib/sn[^a]** -> cri-containerd.apparmor.d, 285 change_profile unsafe /snap/core/*/usr/lib/sna[^p]** -> cri-containerd.apparmor.d, 286 change_profile unsafe /snap/core/*/usr/lib/snap[^d]** -> cri-containerd.apparmor.d, 287 change_profile unsafe /snap/core/*/usr/lib/snapd[^/]** -> cri-containerd.apparmor.d, 288 change_profile unsafe /snap/core/*/usr/lib/snapd/[^s]** -> cri-containerd.apparmor.d, 289 change_profile unsafe /snap/core/*/usr/lib/snapd/s[^n]** -> cri-containerd.apparmor.d, 290 change_profile unsafe /snap/core/*/usr/lib/snapd/sn[^a]** -> cri-containerd.apparmor.d, 291 change_profile unsafe /snap/core/*/usr/lib/snapd/sna[^p]** -> cri-containerd.apparmor.d, 292 change_profile unsafe /snap/core/*/usr/lib/snapd/snap[^-]** -> cri-containerd.apparmor.d, 293 change_profile unsafe /snap/core/*/usr/lib/snapd/snap-[^c]** -> cri-containerd.apparmor.d, 294 change_profile unsafe /snap/core/*/usr/lib/snapd/snap-c[^o]** -> cri-containerd.apparmor.d, 295 change_profile unsafe /snap/core/*/usr/lib/snapd/snap-co[^n]** -> cri-containerd.apparmor.d, 296 change_profile unsafe /snap/core/*/usr/lib/snapd/snap-con[^f]** -> cri-containerd.apparmor.d, 297 change_profile unsafe /snap/core/*/usr/lib/snapd/snap-conf[^i]** -> cri-containerd.apparmor.d, 298 change_profile unsafe /snap/core/*/usr/lib/snapd/snap-confi[^n]** -> cri-containerd.apparmor.d, 299 change_profile unsafe /snap/core/*/usr/lib/snapd/snap-confin[^e]** -> cri-containerd.apparmor.d, 300 301 # branch for the /snap/snapd/... paths 302 change_profile unsafe /snap/snap[^d]** -> cri-containerd.apparmor.d, 303 change_profile unsafe /snap/snapd[^/]** -> cri-containerd.apparmor.d, 304 change_profile unsafe /snap/snapd/*/[^u]** -> cri-containerd.apparmor.d, 305 change_profile unsafe /snap/snapd/*/u[^s]** -> cri-containerd.apparmor.d, 306 change_profile unsafe /snap/snapd/*/us[^r]** -> cri-containerd.apparmor.d, 307 change_profile unsafe /snap/snapd/*/usr[^/]** -> cri-containerd.apparmor.d, 308 change_profile unsafe /snap/snapd/*/usr/[^l]** -> cri-containerd.apparmor.d, 309 change_profile unsafe /snap/snapd/*/usr/l[^i]** -> cri-containerd.apparmor.d, 310 change_profile unsafe /snap/snapd/*/usr/li[^b]** -> cri-containerd.apparmor.d, 311 change_profile unsafe /snap/snapd/*/usr/lib[^/]** -> cri-containerd.apparmor.d, 312 change_profile unsafe /snap/snapd/*/usr/lib/[^s]** -> cri-containerd.apparmor.d, 313 change_profile unsafe /snap/snapd/*/usr/lib/s[^n]** -> cri-containerd.apparmor.d, 314 change_profile unsafe /snap/snapd/*/usr/lib/sn[^a]** -> cri-containerd.apparmor.d, 315 change_profile unsafe /snap/snapd/*/usr/lib/sna[^p]** -> cri-containerd.apparmor.d, 316 change_profile unsafe /snap/snapd/*/usr/lib/snap[^d]** -> cri-containerd.apparmor.d, 317 change_profile unsafe /snap/snapd/*/usr/lib/snapd[^/]** -> cri-containerd.apparmor.d, 318 change_profile unsafe /snap/snapd/*/usr/lib/snapd/[^s]** -> cri-containerd.apparmor.d, 319 change_profile unsafe /snap/snapd/*/usr/lib/snapd/s[^n]** -> cri-containerd.apparmor.d, 320 change_profile unsafe /snap/snapd/*/usr/lib/snapd/sn[^a]** -> cri-containerd.apparmor.d, 321 change_profile unsafe /snap/snapd/*/usr/lib/snapd/sna[^p]** -> cri-containerd.apparmor.d, 322 change_profile unsafe /snap/snapd/*/usr/lib/snapd/snap[^-]** -> cri-containerd.apparmor.d, 323 change_profile unsafe /snap/snapd/*/usr/lib/snapd/snap-[^c]** -> cri-containerd.apparmor.d, 324 change_profile unsafe /snap/snapd/*/usr/lib/snapd/snap-c[^o]** -> cri-containerd.apparmor.d, 325 change_profile unsafe /snap/snapd/*/usr/lib/snapd/snap-co[^n]** -> cri-containerd.apparmor.d, 326 change_profile unsafe /snap/snapd/*/usr/lib/snapd/snap-con[^f]** -> cri-containerd.apparmor.d, 327 change_profile unsafe /snap/snapd/*/usr/lib/snapd/snap-conf[^i]** -> cri-containerd.apparmor.d, 328 change_profile unsafe /snap/snapd/*/usr/lib/snapd/snap-confi[^n]** -> cri-containerd.apparmor.d, 329 change_profile unsafe /snap/snapd/*/usr/lib/snapd/snap-confin[^e]** -> cri-containerd.apparmor.d, 330 331 # signal/tracing rules too 332 signal (send) peer=cri-containerd.apparmor.d, 333 ptrace (read, trace) peer=cri-containerd.apparmor.d, 334 335 # Graph (storage) driver bits 336 /{dev,run}/shm/aufs.xino mrw, 337 /proc/fs/aufs/plink_maint w, 338 /sys/fs/aufs/** r, 339 340 #cf bug 1502785 341 / r, 342 343 # recent versions of docker make a symlink from /dev/ptmx to /dev/pts/ptmx 344 # and so to allow allocating a new shell we need this 345 /dev/pts/ptmx rw, 346 347 # needed by runc for mitigation of CVE-2019-5736 348 # For details see https://bugs.launchpad.net/apparmor/+bug/1820344 349 / ix, 350 /bin/runc ixr, 351 352 /pause ixr, 353 /bin/busybox ixr, 354 355 # When kubernetes drives containerd, containerd needs access to CNI services, 356 # like flanneld's subnet.env for DNS. This would ideally be snap-specific (it 357 # could if the control plane was a snap), but in deployments where the control 358 # plane is not a snap, it will tell flannel to use this path. 359 /run/flannel/{,**} rk, 360 361 # When kubernetes drives containerd, containerd needs access to various 362 # secrets for the pods which are overlayed at /run/secrets/.... 363 # This would ideally be snap-specific (it could if the control plane was a 364 # snap), but in deployments where the control plane is not a snap, it will tell 365 # containerd to use this path for various account information for pods. 366 /run/secrets/kubernetes.io/{,**} rk, 367 368 # Allow using the 'autobind' feature of bind() (eg, for journald via go-systemd) 369 # unix (bind) type=dgram addr=auto, 370 # TODO: when snapd vendors in AppArmor userspace, then enable the new syntax 371 # above which allows only "empty"/automatic addresses, for now we simply permit 372 # all addresses with SOCK_DGRAM type, which leaks info for other addresses than 373 # what docker tries to use 374 # see https://bugs.launchpad.net/snapd/+bug/1867216 375 unix (bind) type=dgram, 376 377 # With cgroup v2, docker uses the systemd driver to run the containers, 378 # which requires dockerd to talk to systemd over system bus. 379 dbus (send) 380 bus=system 381 path=/org/freedesktop/systemd1 382 interface=org.freedesktop.systemd1.Manager 383 member={StartTransientUnit,KillUnit,StopUnit,ResetFailedUnit,SetUnitProperties} 384 peer=(name=org.freedesktop.systemd1,label=unconfined), 385 386 dbus (receive) 387 bus=system 388 path=/org/freedesktop/systemd1 389 interface=org.freedesktop.systemd1.Manager 390 member=JobRemoved 391 peer=(label=unconfined), 392 393 dbus (send) 394 bus=system 395 interface=org.freedesktop.DBus.Properties 396 path=/org/freedesktop/systemd1 397 member=Get{,All} 398 peer=(name=org.freedesktop.systemd1,label=unconfined), 399 400 ` 401 402 const dockerSupportConnectedPlugSecComp = ` 403 # Description: allow operating as the Docker daemon. This policy is 404 # intentionally not restrictive and is here to help guard against programming 405 # errors and not for security confinement. The Docker daemon by design requires 406 # extensive access to the system and cannot be effectively confined against 407 # malicious activity. 408 409 # Because seccomp may only go more strict, we must allow all syscalls to Docker 410 # that it expects to give to containers in addition to what it needs to run and 411 # trust that docker daemon # only gives out reasonable syscalls to containers. 412 413 # Docker includes these in the default container whitelist, but they're 414 # potentially dangerous. 415 #finit_module 416 #init_module 417 #query_module 418 #delete_module 419 420 # These have a history of vulnerabilities, are not widely used, and 421 # open_by_handle_at has been used to break out of Docker containers by brute 422 # forcing the handle value: http://stealth.openwall.net/xSports/shocker.c 423 #name_to_handle_at 424 #open_by_handle_at 425 426 # Calls the Docker daemon itself requires 427 428 # /snap/docker/VERSION/bin/docker-runc 429 # "do not inherit the parent's session keyring" 430 # "make session keyring searcheable" 431 # runC uses this to ensure the container doesn't have access to the host 432 # keyring 433 keyctl 434 435 # /snap/docker/VERSION/bin/docker-runc 436 pivot_root 437 438 # ptrace can be abused to break out of the seccomp sandbox 439 # but is required by the Docker daemon. 440 ptrace 441 442 # This list comes from Docker's default seccomp whitelist (which is applied to 443 # all containers launched unless a custom profile is specified or 444 # "--privileged" is used) 445 # https://github.com/docker/docker/blob/v1.12.0/profiles/seccomp/seccomp_default.go#L39-L1879 446 # It has been further filtered to exclude certain known-troublesome syscalls. 447 accept 448 accept4 449 access 450 acct 451 adjtimex 452 alarm 453 arch_prctl 454 bind 455 bpf 456 breakpoint 457 brk 458 cacheflush 459 capget 460 capset 461 chdir 462 chmod 463 chown 464 chown32 465 chroot 466 clock_getres 467 clock_getres_time64 468 clock_gettime 469 clock_gettime64 470 clock_nanosleep 471 clock_nanosleep_time64 472 clone 473 close 474 connect 475 copy_file_range 476 creat 477 dup 478 dup2 479 dup3 480 epoll_create 481 epoll_create1 482 epoll_ctl 483 epoll_ctl_old 484 epoll_pwait 485 epoll_wait 486 epoll_wait_old 487 eventfd 488 eventfd2 489 execve 490 execveat 491 exit 492 exit_group 493 faccessat 494 fadvise64 495 fadvise64_64 496 fallocate 497 fanotify_init 498 fanotify_mark 499 fchdir 500 fchmod 501 fchmodat 502 fchown 503 fchown32 504 fchownat 505 fcntl 506 fcntl64 507 fdatasync 508 fgetxattr 509 flistxattr 510 flock 511 fork 512 fremovexattr 513 fsetxattr 514 fstat 515 fstat64 516 fstatat64 517 fstatfs 518 fstatfs64 519 fsync 520 ftruncate 521 ftruncate64 522 futex 523 futex_time64 524 futimesat 525 getcpu 526 getcwd 527 getdents 528 getdents64 529 getegid 530 getegid32 531 geteuid 532 geteuid32 533 getgid 534 getgid32 535 getgroups 536 getgroups32 537 getitimer 538 getpeername 539 getpgid 540 getpgrp 541 getpid 542 getppid 543 getpriority 544 getrandom 545 getresgid 546 getresgid32 547 getresuid 548 getresuid32 549 getrlimit 550 get_robust_list 551 getrusage 552 getsid 553 getsockname 554 getsockopt 555 get_thread_area 556 get_tls 557 gettid 558 gettimeofday 559 getuid 560 getuid32 561 getxattr 562 inotify_add_watch 563 inotify_init 564 inotify_init1 565 inotify_rm_watch 566 io_cancel 567 ioctl 568 io_destroy 569 io_getevents 570 ioperm 571 iopl 572 ioprio_get 573 ioprio_set 574 io_setup 575 io_submit 576 ipc 577 kcmp 578 kill 579 lchown 580 lchown32 581 lgetxattr 582 link 583 linkat 584 listen 585 listxattr 586 llistxattr 587 _llseek 588 lookup_dcookie 589 lremovexattr 590 lseek 591 lsetxattr 592 lstat 593 lstat64 594 madvise 595 memfd_create 596 mincore 597 mkdir 598 mkdirat 599 mknod 600 mknodat 601 mlock 602 mlock2 603 mlockall 604 mmap 605 mmap2 606 modify_ldt 607 mount 608 mprotect 609 mq_getsetattr 610 mq_notify 611 mq_open 612 mq_timedreceive 613 mq_timedreceive_time64 614 mq_timedsend 615 mq_timedsend_time64 616 mq_unlink 617 mremap 618 msgctl 619 msgget 620 msgrcv 621 msgsnd 622 msync 623 munlock 624 munlockall 625 munmap 626 nanosleep 627 newfstatat 628 _newselect 629 open 630 openat 631 pause 632 perf_event_open 633 personality 634 pipe 635 pipe2 636 poll 637 ppoll 638 ppoll_time64 639 prctl 640 pread64 641 preadv 642 prlimit64 643 process_vm_readv 644 process_vm_writev 645 pselect6 646 pselect6_time64 647 pwrite64 648 pwritev 649 read 650 readahead 651 readlink 652 readlinkat 653 readv 654 reboot 655 recv 656 recvfrom 657 recvmmsg 658 recvmmsg_time64 659 recvmsg 660 remap_file_pages 661 removexattr 662 rename 663 renameat 664 renameat2 665 restart_syscall 666 rmdir 667 rt_sigaction 668 rt_sigpending 669 rt_sigprocmask 670 rt_sigqueueinfo 671 rt_sigreturn 672 rt_sigsuspend 673 rt_sigtimedwait 674 rt_sigtimedwait_time64 675 rt_tgsigqueueinfo 676 s390_pci_mmio_read 677 s390_pci_mmio_write 678 s390_runtime_instr 679 sched_getaffinity 680 sched_getattr 681 sched_getparam 682 sched_get_priority_max 683 sched_get_priority_min 684 sched_getscheduler 685 sched_rr_get_interval 686 sched_rr_get_interval_time64 687 sched_setaffinity 688 sched_setattr 689 sched_setparam 690 sched_setscheduler 691 sched_yield 692 seccomp 693 select 694 semctl 695 semget 696 semop 697 semtimedop 698 semtimedop_time64 699 send 700 sendfile 701 sendfile64 702 sendmmsg 703 sendmsg 704 sendto 705 setdomainname 706 setfsgid 707 setfsgid32 708 setfsuid 709 setfsuid32 710 setgid 711 setgid32 712 setgroups 713 setgroups32 714 sethostname 715 setitimer 716 setns 717 setpgid 718 setpriority 719 setregid 720 setregid32 721 setresgid 722 setresgid32 723 setresuid 724 setresuid32 725 setreuid 726 setreuid32 727 setrlimit 728 set_robust_list 729 setsid 730 setsockopt 731 set_thread_area 732 set_tid_address 733 settimeofday 734 set_tls 735 setuid 736 setuid32 737 setxattr 738 shmat 739 shmctl 740 shmdt 741 shmget 742 shutdown 743 sigaltstack 744 signalfd 745 signalfd4 746 sigreturn 747 socket 748 socketcall 749 socketpair 750 splice 751 stat 752 stat64 753 statfs 754 statfs64 755 stime 756 symlink 757 symlinkat 758 sync 759 sync_file_range 760 syncfs 761 sysinfo 762 syslog 763 tee 764 tgkill 765 time 766 timer_create 767 timer_delete 768 timerfd_create 769 timerfd_gettime 770 timerfd_gettime64 771 timerfd_settime 772 timerfd_settime64 773 timer_getoverrun 774 timer_gettime 775 timer_gettime64 776 timer_settime 777 timer_settime64 778 times 779 tkill 780 truncate 781 truncate64 782 ugetrlimit 783 umask 784 umount 785 umount2 786 uname 787 unlink 788 unlinkat 789 unshare 790 utime 791 utimensat 792 utimensat_time64 793 utimes 794 vfork 795 vhangup 796 vmsplice 797 wait4 798 waitid 799 waitpid 800 write 801 writev 802 ` 803 804 const dockerSupportPrivilegedAppArmor = ` 805 # Description: allow docker daemon to run privileged containers. This gives 806 # full access to all resources on the system and thus gives device ownership to 807 # connected snaps. 808 809 # These rules are here to allow Docker to launch unconfined containers but 810 # allow the docker daemon itself to go unconfined. Since it runs as root, this 811 # grants device ownership. 812 # TODO: When we drop support for executing other snaps from devmode snaps (or 813 # when the AppArmor parser bugs are fixed) this can go back to the much simpler 814 # rule: 815 # change_profile unsafe /**, 816 # but until then we need this set of rules to avoid exec transition conflicts. 817 # See also the comment above the "change_profile unsafe /** -> docker-default," 818 # rule for more context. 819 change_profile unsafe /[^s]**, 820 change_profile unsafe /s[^n]**, 821 change_profile unsafe /sn[^a]**, 822 change_profile unsafe /sna[^p]**, 823 change_profile unsafe /snap[^/]**, 824 change_profile unsafe /snap/[^sc]**, 825 change_profile unsafe /snap/{s[^n],c[^o]}**, 826 change_profile unsafe /snap/{sn[^a],co[^r]}**, 827 change_profile unsafe /snap/{sna[^p],cor[^e]}**, 828 829 # branch for the /snap/core/... paths 830 change_profile unsafe /snap/core[^/]**, 831 change_profile unsafe /snap/core/*/[^u]**, 832 change_profile unsafe /snap/core/*/u[^s]**, 833 change_profile unsafe /snap/core/*/us[^r]**, 834 change_profile unsafe /snap/core/*/usr[^/]**, 835 change_profile unsafe /snap/core/*/usr/[^l]**, 836 change_profile unsafe /snap/core/*/usr/l[^i]**, 837 change_profile unsafe /snap/core/*/usr/li[^b]**, 838 change_profile unsafe /snap/core/*/usr/lib[^/]**, 839 change_profile unsafe /snap/core/*/usr/lib/[^s]**, 840 change_profile unsafe /snap/core/*/usr/lib/s[^n]**, 841 change_profile unsafe /snap/core/*/usr/lib/sn[^a]**, 842 change_profile unsafe /snap/core/*/usr/lib/sna[^p]**, 843 change_profile unsafe /snap/core/*/usr/lib/snap[^d]**, 844 change_profile unsafe /snap/core/*/usr/lib/snapd[^/]**, 845 change_profile unsafe /snap/core/*/usr/lib/snapd/[^s]**, 846 change_profile unsafe /snap/core/*/usr/lib/snapd/s[^n]**, 847 change_profile unsafe /snap/core/*/usr/lib/snapd/sn[^a]**, 848 change_profile unsafe /snap/core/*/usr/lib/snapd/sna[^p]**, 849 change_profile unsafe /snap/core/*/usr/lib/snapd/snap[^-]**, 850 change_profile unsafe /snap/core/*/usr/lib/snapd/snap-[^c]**, 851 change_profile unsafe /snap/core/*/usr/lib/snapd/snap-c[^o]**, 852 change_profile unsafe /snap/core/*/usr/lib/snapd/snap-co[^n]**, 853 change_profile unsafe /snap/core/*/usr/lib/snapd/snap-con[^f]**, 854 change_profile unsafe /snap/core/*/usr/lib/snapd/snap-conf[^i]**, 855 change_profile unsafe /snap/core/*/usr/lib/snapd/snap-confi[^n]**, 856 change_profile unsafe /snap/core/*/usr/lib/snapd/snap-confin[^e]**, 857 858 # branch for the /snap/snapd/... paths 859 change_profile unsafe /snap/snap[^d]**, 860 change_profile unsafe /snap/snapd[^/]**, 861 change_profile unsafe /snap/snapd/*/[^u]**, 862 change_profile unsafe /snap/snapd/*/u[^s]**, 863 change_profile unsafe /snap/snapd/*/us[^r]**, 864 change_profile unsafe /snap/snapd/*/usr[^/]**, 865 change_profile unsafe /snap/snapd/*/usr/[^l]**, 866 change_profile unsafe /snap/snapd/*/usr/l[^i]**, 867 change_profile unsafe /snap/snapd/*/usr/li[^b]**, 868 change_profile unsafe /snap/snapd/*/usr/lib[^/]**, 869 change_profile unsafe /snap/snapd/*/usr/lib/[^s]**, 870 change_profile unsafe /snap/snapd/*/usr/lib/s[^n]**, 871 change_profile unsafe /snap/snapd/*/usr/lib/sn[^a]**, 872 change_profile unsafe /snap/snapd/*/usr/lib/sna[^p]**, 873 change_profile unsafe /snap/snapd/*/usr/lib/snap[^d]**, 874 change_profile unsafe /snap/snapd/*/usr/lib/snapd[^/]**, 875 change_profile unsafe /snap/snapd/*/usr/lib/snapd/[^s]**, 876 change_profile unsafe /snap/snapd/*/usr/lib/snapd/s[^n]**, 877 change_profile unsafe /snap/snapd/*/usr/lib/snapd/sn[^a]**, 878 change_profile unsafe /snap/snapd/*/usr/lib/snapd/sna[^p]**, 879 change_profile unsafe /snap/snapd/*/usr/lib/snapd/snap[^-]**, 880 change_profile unsafe /snap/snapd/*/usr/lib/snapd/snap-[^c]**, 881 change_profile unsafe /snap/snapd/*/usr/lib/snapd/snap-c[^o]**, 882 change_profile unsafe /snap/snapd/*/usr/lib/snapd/snap-co[^n]**, 883 change_profile unsafe /snap/snapd/*/usr/lib/snapd/snap-con[^f]**, 884 change_profile unsafe /snap/snapd/*/usr/lib/snapd/snap-conf[^i]**, 885 change_profile unsafe /snap/snapd/*/usr/lib/snapd/snap-confi[^n]**, 886 change_profile unsafe /snap/snapd/*/usr/lib/snapd/snap-confin[^e]**, 887 888 # allow signaling and tracing any unconfined process since if containers are 889 # launched without confinement docker still needs to trace them 890 signal (send) peer=unconfined, 891 ptrace (read, trace) peer=unconfined, 892 893 # This grants raw access to device files and thus device ownership 894 /dev/** mrwkl, 895 @{PROC}/** mrwkl, 896 897 # When kubernetes drives docker/containerd, it creates and runs files in the 898 # container at arbitrary locations (eg, via pivot_root). 899 # Allow any file except for executing /snap/{snapd,core}/*/usr/lib/snapd/snap-confine 900 # because in devmode confinement we will have a separate "x" transition on exec 901 # rule that is in the policy that will overlap and thus conflict with this rule. 902 # TODO: When we drop support for executing other snaps from devmode snaps (or 903 # when the AppArmor parser bugs are fixed) this can go back to the much simpler 904 # rule: 905 # /** rwlix, 906 # but until then we need this set of rules to avoid exec transition conflicts. 907 # See also the comment above the "change_profile unsafe /** -> docker-default," 908 # rule for more context. 909 /[^s]** rwlix, 910 /s[^n]** rwlix, 911 /sn[^a]** rwlix, 912 /sna[^p]** rwlix, 913 /snap/[^sc]** rwlix, 914 /snap/{s[^n],c[^o]}** rwlix, 915 /snap/{sn[^a],co[^r]}** rwlix, 916 /snap/{sna[^p],cor[^e]}** rwlix, 917 918 # branch for the /snap/core/... paths 919 /snap/core[^/]** rwlix, 920 /snap/core/*/[^u]** rwlix, 921 /snap/core/*/u[^s]** rwlix, 922 /snap/core/*/us[^r]** rwlix, 923 /snap/core/*/usr[^/]** rwlix, 924 /snap/core/*/usr/[^l]** rwlix, 925 /snap/core/*/usr/l[^i]** rwlix, 926 /snap/core/*/usr/li[^b]** rwlix, 927 /snap/core/*/usr/lib[^/]** rwlix, 928 /snap/core/*/usr/lib/[^s]** rwlix, 929 /snap/core/*/usr/lib/s[^n]** rwlix, 930 /snap/core/*/usr/lib/sn[^a]** rwlix, 931 /snap/core/*/usr/lib/sna[^p]** rwlix, 932 /snap/core/*/usr/lib/snap[^d]** rwlix, 933 /snap/core/*/usr/lib/snapd[^/]** rwlix, 934 /snap/core/*/usr/lib/snapd/[^s]** rwlix, 935 /snap/core/*/usr/lib/snapd/s[^n]** rwlix, 936 /snap/core/*/usr/lib/snapd/sn[^a]** rwlix, 937 /snap/core/*/usr/lib/snapd/sna[^p]** rwlix, 938 /snap/core/*/usr/lib/snapd/snap[^-]** rwlix, 939 /snap/core/*/usr/lib/snapd/snap-[^c]** rwlix, 940 /snap/core/*/usr/lib/snapd/snap-c[^o]** rwlix, 941 /snap/core/*/usr/lib/snapd/snap-co[^n]** rwlix, 942 /snap/core/*/usr/lib/snapd/snap-con[^f]** rwlix, 943 /snap/core/*/usr/lib/snapd/snap-conf[^i]** rwlix, 944 /snap/core/*/usr/lib/snapd/snap-confi[^n]** rwlix, 945 /snap/core/*/usr/lib/snapd/snap-confin[^e]** rwlix, 946 947 # branch for the /snap/snapd/... paths 948 /snap/snap[^d]** rwlix, 949 /snap/snapd[^/]** rwlix, 950 /snap/snapd/*/[^u]** rwlix, 951 /snap/snapd/*/u[^s]** rwlix, 952 /snap/snapd/*/us[^r]** rwlix, 953 /snap/snapd/*/usr[^/]** rwlix, 954 /snap/snapd/*/usr/[^l]** rwlix, 955 /snap/snapd/*/usr/l[^i]** rwlix, 956 /snap/snapd/*/usr/li[^b]** rwlix, 957 /snap/snapd/*/usr/lib[^/]** rwlix, 958 /snap/snapd/*/usr/lib/[^s]** rwlix, 959 /snap/snapd/*/usr/lib/s[^n]** rwlix, 960 /snap/snapd/*/usr/lib/sn[^a]** rwlix, 961 /snap/snapd/*/usr/lib/sna[^p]** rwlix, 962 /snap/snapd/*/usr/lib/snap[^d]** rwlix, 963 /snap/snapd/*/usr/lib/snapd[^/]** rwlix, 964 /snap/snapd/*/usr/lib/snapd/[^s]** rwlix, 965 /snap/snapd/*/usr/lib/snapd/s[^n]** rwlix, 966 /snap/snapd/*/usr/lib/snapd/sn[^a]** rwlix, 967 /snap/snapd/*/usr/lib/snapd/sna[^p]** rwlix, 968 /snap/snapd/*/usr/lib/snapd/snap[^-]** rwlix, 969 /snap/snapd/*/usr/lib/snapd/snap-[^c]** rwlix, 970 /snap/snapd/*/usr/lib/snapd/snap-c[^o]** rwlix, 971 /snap/snapd/*/usr/lib/snapd/snap-co[^n]** rwlix, 972 /snap/snapd/*/usr/lib/snapd/snap-con[^f]** rwlix, 973 /snap/snapd/*/usr/lib/snapd/snap-conf[^i]** rwlix, 974 /snap/snapd/*/usr/lib/snapd/snap-confi[^n]** rwlix, 975 /snap/snapd/*/usr/lib/snapd/snap-confin[^e]** rwlix, 976 ` 977 978 const dockerSupportPrivilegedSecComp = ` 979 # Description: allow docker daemon to run privileged containers. This gives 980 # full access to all resources on the system and thus gives device ownership to 981 # connected snaps. 982 983 # This grants, among other things, kernel module loading and therefore device 984 # ownership. 985 @unrestricted 986 ` 987 988 const dockerSupportServiceSnippet = `Delegate=true` 989 990 type dockerSupportInterface struct { 991 commonInterface 992 } 993 994 func (iface *dockerSupportInterface) KModConnectedPlug(spec *kmod.Specification, plug *interfaces.ConnectedPlug, slot *interfaces.ConnectedSlot) error { 995 // https://kubernetes.io/docs/setup/production-environment/container-runtimes/ 996 if err := spec.AddModule("overlay"); err != nil { 997 return err 998 } 999 return nil 1000 } 1001 1002 func (iface *dockerSupportInterface) AppArmorConnectedPlug(spec *apparmor.Specification, plug *interfaces.ConnectedPlug, slot *interfaces.ConnectedSlot) error { 1003 var privileged bool 1004 _ = plug.Attr("privileged-containers", &privileged) 1005 1006 // The 'change_profile unsafe' rules conflict with the 'ix' rules in 1007 // the home interface, so suppress them (LP: #1797786) 1008 spec.SetSuppressHomeIx() 1009 spec.AddSnippet(dockerSupportConnectedPlugAppArmor) 1010 if privileged { 1011 spec.AddSnippet(dockerSupportPrivilegedAppArmor) 1012 } 1013 if !release.OnClassic { 1014 spec.AddSnippet(dockerSupportConnectedPlugAppArmorCore) 1015 } 1016 spec.SetUsesPtraceTrace() 1017 return nil 1018 } 1019 1020 func (iface *dockerSupportInterface) SecCompConnectedPlug(spec *seccomp.Specification, plug *interfaces.ConnectedPlug, slot *interfaces.ConnectedSlot) error { 1021 var privileged bool 1022 _ = plug.Attr("privileged-containers", &privileged) 1023 snippet := dockerSupportConnectedPlugSecComp 1024 if privileged { 1025 snippet += dockerSupportPrivilegedSecComp 1026 } 1027 spec.AddSnippet(snippet) 1028 return nil 1029 } 1030 1031 func (iface *dockerSupportInterface) BeforePreparePlug(plug *snap.PlugInfo) error { 1032 if v, ok := plug.Attrs["privileged-containers"]; ok { 1033 if _, ok = v.(bool); !ok { 1034 return fmt.Errorf("docker-support plug requires bool with 'privileged-containers'") 1035 } 1036 } 1037 return nil 1038 } 1039 1040 func (iface *dockerSupportInterface) AutoConnect(*snap.PlugInfo, *snap.SlotInfo) bool { 1041 // allow what declarations allowed 1042 return true 1043 } 1044 1045 func init() { 1046 registerIface(&dockerSupportInterface{commonInterface{ 1047 name: "docker-support", 1048 summary: dockerSupportSummary, 1049 implicitOnCore: true, 1050 implicitOnClassic: true, 1051 baseDeclarationPlugs: dockerSupportBaseDeclarationPlugs, 1052 baseDeclarationSlots: dockerSupportBaseDeclarationSlots, 1053 controlsDeviceCgroup: true, 1054 serviceSnippets: []string{dockerSupportServiceSnippet}, 1055 // docker-support also uses ptrace(trace), but it already declares this in 1056 // the AppArmorConnectedPlug method 1057 }}) 1058 }