[Debian][aa profiles] Also deny /proc/acpi to the containers

[P-EB]

Hi,

It occurred to me via bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=906805 on Debian that LXC might be vulnerable to CVE-2018-10892.

I gave a look at the apparmor profiles and the source code, and nothing seems to mask /proc/acpi from the container when it's not an unprivileged one.

Did I miss something? Otherwise maybe it'd be a good idea to prevent the access to /proc/acpi via apparmor, or, better, via the core code of LXC with, potentially, a config parameter to allow the access to /proc/acpi?

With best regards <3

[stgraber]

Ah yeah, sounds like something we should have an apparmor deny for that one too.
Want to send a PR that adds it?

[P-EB]

@stgraber I could do it yeah, just confirm me that this diff is fine with you

diff --git a/config/apparmor/abstractions/container-base.in b/config/apparmor/abstractions/container-base.in  
index 1a3ead8..2606fb6 100644                                                                                 
--- a/config/apparmor/abstractions/container-base.in                                                          
+++ b/config/apparmor/abstractions/container-base.in                                                          
@@ -73,6 +73,7 @@                                                                                             
   # block some other dangerous paths                                                                         
   deny @{PROC}/kcore rwklx,                                                                                  
   deny @{PROC}/sysrq-trigger rwklx,                                                                          
+  deny @{PROC}/acpi/** rwklx,                                                                                
                                                                                                              
   # deny writes in /sys except for /sys/fs/cgroup, also allow                                                
   # fusectl, securityfs and debugfs to be mounted there (read-only) 

[P-EB]

@stgraber done