github.com/sijibomii/docker@v0.0.0-20231230191044-5cf6ca554647/docs/security/apparmor.md (about)

     1  <!-- [metadata]>
     2  +++
     3  title = "AppArmor security profiles for Docker"
     4  description = "Enabling AppArmor in Docker"
     5  keywords = ["AppArmor, security, docker, documentation"]
     6  [menu.main]
     7  parent= "smn_secure_docker"
     8  weight=5
     9  +++
    10  <![end-metadata]-->
    11  
    12  # AppArmor security profiles for Docker
    13  
    14  AppArmor (Application Armor) is a Linux security module that protects an
    15  operating system and its applications from security threats. To use it, a system
    16  administrator associates an AppArmor security profile with each program. Docker
    17  expects to find an AppArmor policy loaded and enforced.
    18  
    19  Docker automatically loads container profiles. The Docker binary installs
    20  a `docker-default` profile in the `/etc/apparmor.d/docker` file. This profile
    21  is used on containers, _not_ on the Docker Daemon.
    22  
    23  A profile for the Docker Engine Daemon exists but it is not currently installed 
    24  with the deb packages. If you are interested in the source for the Daemon
    25  profile, it is located in
    26  [contrib/apparmor](https://github.com/docker/docker/tree/master/contrib/apparmor)
    27  in the Docker Engine source repository.
    28  
    29  ## Understand the policies
    30  
    31  The `docker-default` profile is the default for running containers. It is
    32  moderately protective while providing wide application compatibility. The
    33  profile is the following:
    34  
    35  ```
    36  #include <tunables/global>
    37  
    38  
    39  profile docker-default flags=(attach_disconnected,mediate_deleted) {
    40  
    41    #include <abstractions/base>
    42  
    43  
    44    network,
    45    capability,
    46    file,
    47    umount,
    48  
    49    deny @{PROC}/{*,**^[0-9*],sys/kernel/shm*} wkx,
    50    deny @{PROC}/sysrq-trigger rwklx,
    51    deny @{PROC}/mem rwklx,
    52    deny @{PROC}/kmem rwklx,
    53    deny @{PROC}/kcore rwklx,
    54  
    55    deny mount,
    56  
    57    deny /sys/[^f]*/** wklx,
    58    deny /sys/f[^s]*/** wklx,
    59    deny /sys/fs/[^c]*/** wklx,
    60    deny /sys/fs/c[^g]*/** wklx,
    61    deny /sys/fs/cg[^r]*/** wklx,
    62    deny /sys/firmware/efi/efivars/** rwklx,
    63    deny /sys/kernel/security/** rwklx,
    64  }
    65  ```
    66  
    67  When you run a container, it uses the `docker-default` policy unless you
    68  override it with the `security-opt` option. For example, the following
    69  explicitly specifies the default policy:
    70  
    71  ```bash
    72  $ docker run --rm -it --security-opt apparmor=docker-default hello-world
    73  ```
    74  
    75  ## Loading and Unloading Profiles
    76  
    77  To load a new profile into AppArmor, for use with containers:
    78  
    79  ```
    80  $ apparmor_parser -r -W /path/to/your_profile
    81  ```
    82  
    83  Then you can run the custom profile with `--security-opt` like so:
    84  
    85  ```bash
    86  $ docker run --rm -it --security-opt apparmor=your_profile hello-world
    87  ```
    88  
    89  To unload a profile from AppArmor:
    90  
    91  ```bash
    92  # stop apparmor
    93  $ /etc/init.d/apparmor stop
    94  # unload the profile
    95  $ apparmor_parser -R /path/to/profile
    96  # start apparmor
    97  $ /etc/init.d/apparmor start
    98  ```
    99  
   100  ## Debugging AppArmor
   101  
   102  ### Using `dmesg`
   103  
   104  Here are some helpful tips for debugging any problems you might be facing with
   105  regard to AppArmor.
   106  
   107  AppArmor sends quite verbose messaging to `dmesg`. Usually an AppArmor line
   108  will look like the following:
   109  
   110  ```
   111  [ 5442.864673] audit: type=1400 audit(1453830992.845:37): apparmor="ALLOWED" operation="open" profile="/usr/bin/docker" name="/home/jessie/docker/man/man1/docker-attach.1" pid=10923 comm="docker" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
   112  ```
   113  
   114  In the above example, the you can see `profile=/usr/bin/docker`. This means the
   115  user has the `docker-engine` (Docker Engine Daemon) profile loaded.
   116  
   117  > **Note:** On version of Ubuntu > 14.04 this is all fine and well, but Trusty
   118  > users might run into some issues when trying to `docker exec`.
   119  
   120  Let's look at another log line:
   121  
   122  ```
   123  [ 3256.689120] type=1400 audit(1405454041.341:73): apparmor="DENIED" operation="ptrace" profile="docker-default" pid=17651 comm="docker" requested_mask="receive" denied_mask="receive"
   124  ```
   125  
   126  This time the profile is `docker-default`, which is run on containers by
   127  default unless in `privileged` mode. It is telling us, that apparmor has denied
   128  `ptrace` in the container. This is great.
   129  
   130  ### Using `aa-status`
   131  
   132  If you need to check which profiles are loaded you can use `aa-status`. The
   133  output looks like:
   134  
   135  ```bash
   136  $ sudo aa-status
   137  apparmor module is loaded.
   138  14 profiles are loaded.
   139  1 profiles are in enforce mode.
   140     docker-default
   141  13 profiles are in complain mode.
   142     /usr/bin/docker
   143     /usr/bin/docker///bin/cat
   144     /usr/bin/docker///bin/ps
   145     /usr/bin/docker///sbin/apparmor_parser
   146     /usr/bin/docker///sbin/auplink
   147     /usr/bin/docker///sbin/blkid
   148     /usr/bin/docker///sbin/iptables
   149     /usr/bin/docker///sbin/mke2fs
   150     /usr/bin/docker///sbin/modprobe
   151     /usr/bin/docker///sbin/tune2fs
   152     /usr/bin/docker///sbin/xtables-multi
   153     /usr/bin/docker///sbin/zfs
   154     /usr/bin/docker///usr/bin/xz
   155  38 processes have profiles defined.
   156  37 processes are in enforce mode.
   157     docker-default (6044)
   158     ...
   159     docker-default (31899)
   160  1 processes are in complain mode.
   161     /usr/bin/docker (29756)
   162  0 processes are unconfined but have a profile defined.
   163  ```
   164  
   165  In the above output you can tell that the `docker-default` profile running on
   166  various container PIDs is in `enforce` mode. This means AppArmor will actively
   167  block and audit in `dmesg` anything outside the bounds of the `docker-default`
   168  profile.
   169  
   170  The output above also shows the `/usr/bin/docker` (Docker Engine Daemon)
   171  profile is running in `complain` mode. This means AppArmor will _only_ log to
   172  `dmesg` activity outside the bounds of the profile. (Except in the case of
   173  Ubuntu Trusty, where we have seen some interesting behaviors being enforced.)
   174  
   175  ## Contributing to AppArmor code in Docker
   176  
   177  Advanced users and package managers can find a profile for `/usr/bin/docker`
   178  (Docker Engine Daemon) underneath
   179  [contrib/apparmor](https://github.com/docker/docker/tree/master/contrib/apparmor)
   180  in the Docker Engine source repository.
   181  
   182  The `docker-default` profile for containers lives in
   183  [profiles/apparmor](https://github.com/docker/docker/tree/master/profiles/apparmor).