apparmor: handle signal mediation #4467
Conversation
cyphar
force-pushed
the
apparmor-update-profile
branch
from
4b36181
to
e35e5f1
Compare
|
Build succeeded.
|
cyphar
force-pushed
the
apparmor-update-profile
branch
from
e35e5f1
to
4084343
Compare
|
/cc @vrothberg You might care about discussions of having a single package that does this, since libpod also has a copy of this code too. |
|
Build succeeded.
|
Thanks for the ping! CRI-O, Podman, Buildah and Skopeo (and possibly Sarus) share |
|
I am fine either way.I don't see why Moby and Containerd cannot use containers/common. But if we want to create a new repo, I am fine with that also. |
|
Well, the |
Sure! Contributions, maintainers, etc. more than welcome :) |
AkihiroSuda
added
the
cherry-pick/1.4.x
|
@cyphar I see there's some pending review comments, could you have a look at those? |
cyphar
force-pushed
the
apparmor-update-profile
branch
from
4084343
to
58d67c0
Compare
|
Build succeeded.
|
|
How can we test this? Adding automated tests would be preferable, but just explaining manual testing steps in the git commit message would be also ok for now. |
|
We've found that we need this pulled in for successful operation on SLES. Is there anything we can do to help move this along? |
cyphar
force-pushed
the
apparmor-update-profile
branch
from
58d67c0
to
3d0288a
Compare
|
/ping @AkihiroSuda |
I can add a comment to the commit message but the test is "without this change, containers cannot send signals at all and the container runtime cannot kill them". The reason this doesn't happen on all distributions is that it depends on whether |
cyphar
force-pushed
the
apparmor-update-profile
branch
from
3d0288a
to
cdd2bb3
Compare
On newer kernels and systems, AppArmor will block sending signals in many scenarios by default resulting in strange behaviours (container programs cannot signal each other, or host processes like containerd cannot signal containers). The reason this happens only on some distributions (and is not a kernel regression) is that the kernel doesn't enforce signal mediation unless the profile contains signal rules. However because our profies #include the distribution-managed <abstractions/base>, some distributions added signal rules -- which results in AppArmor enforcing signal mediation and thus a regression. On these systems, containers cannot send and receive signals at all -- meaning they cannot signal each other and the container runtime cannot kill them either. This issue was fixed in Docker in 2018[1] but this code was copied before then and thus the patches weren't carried. It also contains a new fix for a more esoteric case[2]. Ideally this code should live in a project like "containerd/apparmor" so that Docker, libpod, and containerd can share it, but that's probably something to do separately. In addition, the copyright header is updated to reference that the code is copied from Docker (and thus was not written entirely by the containerd authors). [1]: moby/moby#37831 [2]: moby/moby#41337 Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
cyphar
force-pushed
the
apparmor-update-profile
branch
from
cdd2bb3
to
d8572b6
Compare
|
Build succeeded.
|
On newer kernels and systems, AppArmor will block sending signals in
many scenarios by default resulting in strange behaviours (container
programs cannot signal each other, or host processes like containerd
cannot signal containers). This issue was fixed in Docker in 2018 but
this code was copied before then and thus the patches weren't carried.
It also contains a new fix for a more esoteric case.
Ideally this code should live in a project like "containerd/apparmor" so
that Docker, libpod, and containerd can share it, but that's probably
something to do separately.
In addition, the copyright header is updated to reference that the code
is copied from Docker (and thus was not written entirely by the
containerd authors).
Signed-off-by: Aleksa Sarai cyphar@cyphar.com