Request: provide AppArmor profile for lxc-user-nic

[CameronNemo]

It is a simple setuid binary and seems like a great candidate for confinement with AppArmor.

[brauner]

If someone wants to work on this we are happy to take a patch.

[CameronNemo]

The following profile is working locally but it surely needs more testing.

#include <tunables/global>

profile lxc-user-nic /usr/lib{,**}/lxc/lxc-user-nic flags=(attach_disconnected) {
  #include <abstractions/base>
  #include <abstractions/nameservice>

  capability setuid,
  capability sys_admin,
  capability sys_ptrace,
  capability net_admin,
  capability sys_module,

  ptrace (read) peer=unconfined,

  / r,
  /sys/module/apparmor/parameters/enabled r,
  /etc/lxc/lxc-usernet    r,
  /{,var/}run/lxc/{,nics} rwk,
}

[brauner]

//cc @stgraber can you give feedback here, please.

[stgraber]

Seems plausibly valid, would be good to have this reviewed by an apparmor person though?

@jdstrand if you have a few minutes to spare?

[jdstrand]

I'm unfamiliar with the lxc-user-nic codebase, but as @stgraber said, this seems reasonable. The only comment I have is that I suspect that you could drop the nameservice abstraction and use something much more specific. Since this is a setuid binary, it might make sense to be a bit more strict. The same could be said of the base abstraction-- it will allow writes to syslog/journald which you may not care about.

[brauner]

We should also investigate whether we can add an option to autotools to replace the setuid bit with file capabilities.