Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

crun doesn't use apparmor stacking if confined and nnp set #1385

Closed
idleroamer opened this issue Jan 15, 2024 · 0 comments · Fixed by #1409
Closed

crun doesn't use apparmor stacking if confined and nnp set #1385

idleroamer opened this issue Jan 15, 2024 · 0 comments · Fixed by #1409

Comments

@idleroamer
Copy link
Contributor

In case crun is confined under apparmor and no_new_privileges flag set for containers,
the only way apparmor allows a change of profile is when a profile is stacked on top of current profile to ensure no new permissions are gained
idleroamer added a commit to idleroamer/crun that referenced this issue Jan 15, 2024
@idleroamer
apparmor: stack apparmor profiles if nnp and confined
e276960 
In case crun is running under apparmor profile and
no_new_privileges flag set for containers
the only way apparmor allows a change of profile
is when a profile is stacked on top of current profile
to ensure no new permissions are gained

Closes: containers#1385
Signed-off-by: 😎Mostafa Emami <mustafaemami@gmail.com>
idleroamer added a commit to idleroamer/crun that referenced this issue Jan 15, 2024
@idleroamer
apparmor: stack apparmor profiles if nnp and confined
f1e9d7f 
In case crun is running under apparmor profile and
no_new_privileges flag set for containers
the only way apparmor allows a change of profile
is when a profile is stacked on top of current profile
to ensure no new permissions are gained

Closes: containers#1385
Signed-off-by: 😎Mostafa Emami <mustafaemami@gmail.com>
idleroamer added a commit to idleroamer/crun that referenced this issue Jan 15, 2024
@idleroamer
apparmor: stack apparmor profiles if nnp and confined
0cfec53 
In case crun is running under apparmor profile and
no_new_privileges flag set for containers
the only way apparmor allows a change of profile
is when a profile is stacked on top of current profile
to ensure no new permissions are gained

Closes: containers#1385
Signed-off-by: 😎Mostafa Emami <mustafaemami@gmail.com>
idleroamer added a commit to idleroamer/crun that referenced this issue Jan 15, 2024
@idleroamer
apparmor: stack apparmor profiles if nnp and confined
ac27cb1 
In case crun is running under apparmor profile and
no_new_privileges flag set for containers
the only way apparmor allows a change of profile
is when a profile is stacked on top of current profile
to ensure no new permissions are gained

Closes: containers#1385
Signed-off-by: 😎Mostafa Emami <mustafaemami@gmail.com>
idleroamer added a commit to idleroamer/crun that referenced this issue Jan 16, 2024
@idleroamer
apparmor: stack apparmor profiles if nnp and confined
935411f 
In case crun is running under apparmor profile and
no_new_privileges flag set for containers
the only way apparmor allows a change of profile
is when a profile is stacked on top of current profile
to ensure no new permissions are gained

Closes: containers#1385
Signed-off-by: 😎Mostafa Emami <mustafaemami@gmail.com>
idleroamer added a commit to idleroamer/crun that referenced this issue Jan 16, 2024
@idleroamer
apparmor: stack apparmor profiles if nnp and confined
140b074 
In case crun is running under apparmor profile and
no_new_privileges flag set for containers
the only way apparmor allows a change of profile
is when a profile is stacked on top of current profile
to ensure no new permissions are gained

Closes: containers#1385
Signed-off-by: 😎Mostafa Emami <mustafaemami@gmail.com>
idleroamer added a commit to idleroamer/crun that referenced this issue Jan 16, 2024
@idleroamer
apparmor: stack apparmor profiles if nnp and confined
eb9c717 
In case crun is running under apparmor profile and
no_new_privileges flag set for containers
the only way apparmor allows a change of profile
is when a profile is stacked on top of current profile
to ensure no new permissions are gained

Closes: containers#1385
Signed-off-by: 😎Mostafa Emami <mustafaemami@gmail.com>
idleroamer added a commit to idleroamer/crun that referenced this issue Jan 16, 2024
@idleroamer
apparmor: stack apparmor profiles if nnp and confined
9bc6c7a 
In case crun is running under apparmor profile and
no_new_privileges flag set for containers
the only way apparmor allows a change of profile
is when a profile is stacked on top of current profile
to ensure no new permissions are gained

Closes: containers#1385
Signed-off-by: 😎Mostafa Emami <mustafaemami@gmail.com>
idleroamer added a commit to idleroamer/crun that referenced this issue Jan 16, 2024
@idleroamer
apparmor: stack apparmor profiles if nnp and confined
5dd672a 
In case crun is running under apparmor profile and
no_new_privileges flag set for containers
the only way apparmor allows a change of profile
is when a profile is stacked on top of current profile
to ensure no new permissions are gained

Closes: containers#1385
Signed-off-by: 😎Mostafa Emami <mustafaemami@gmail.com>
idleroamer added a commit to idleroamer/crun that referenced this issue Jan 16, 2024
@idleroamer
apparmor: stack apparmor profiles if nnp and confined
086855b 
In case crun is running under apparmor profile and
no_new_privileges flag set for containers
the only way apparmor allows a change of profile
is when a profile is stacked on top of current profile
to ensure no new permissions are gained

Closes: containers#1385
Signed-off-by: 😎Mostafa Emami <mustafaemami@gmail.com>
idleroamer added a commit to idleroamer/crun that referenced this issue Jan 16, 2024
@idleroamer
apparmor: stack apparmor profiles if nnp and confined
d314220 
In case crun is running under apparmor profile and
no_new_privileges flag set for containers
the only way apparmor allows a change of profile
is when a profile is stacked on top of current profile
to ensure no new permissions are gained

Closes: containers#1385
Signed-off-by: 😎Mostafa Emami <mustafaemami@gmail.com>
idleroamer added a commit to idleroamer/crun that referenced this issue Jan 17, 2024
@idleroamer
apparmor: stack apparmor profiles if nnp and confined
9a20ad3 
In case crun is running under apparmor profile and
no_new_privileges flag set for containers
the only way apparmor allows a change of profile
is when a profile is stacked on top of current profile
to ensure no new permissions are gained

Closes: containers#1385
Signed-off-by: 😎Mostafa Emami <mustafaemami@gmail.com>
idleroamer added a commit to idleroamer/crun that referenced this issue Feb 1, 2024
@idleroamer
apparmor: Fix wrong determination whether crun is confined
8a767ae 
Closes: containers#1385
Signed-off-by: 😎Mostafa Emami <mustafaemami@gmail.com>
@idleroamer idleroamer mentioned this issue Feb 1, 2024
Merged
idleroamer added a commit to idleroamer/crun that referenced this issue Feb 2, 2024
@idleroamer
apparmor: Fix wrong determination whether crun is confined
7352464 
Closes: containers#1385
Signed-off-by: 😎Mostafa Emami <mustafaemami@gmail.com>
idleroamer added a commit to idleroamer/crun that referenced this issue Feb 2, 2024
@idleroamer
apparmor: Fix wrong determination whether crun is confined
98deadd 
Closes: containers#1385
Signed-off-by: 😎Mostafa Emami <mustafaemami@gmail.com>
idleroamer added a commit to idleroamer/crun that referenced this issue Feb 2, 2024
@idleroamer
apparmor: Fix wrong determination whether crun is confined
278a23d 
Closes: containers#1385
Signed-off-by: 😎Mostafa Emami <mustafaemami@gmail.com>
idleroamer added a commit to idleroamer/crun that referenced this issue Feb 2, 2024
@idleroamer
apparmor: Fix wrong determination whether crun is confined
cb3ffb5 
Closes: containers#1385
Signed-off-by: 😎Mostafa Emami <mustafaemami@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

apparmor: Fix wrong determination whether crun is confined idleroamer/crun
1 participant
@idleroamer