Enable ptrace in a container on apparmor below 2.9

[qzio]

Ubuntu 14.04 LTS is on apparmor 2.8.95.
This line enables ps inside a container without causing
audit log entries on the host.

My use case: #7276 (comment)

[thaJeztah]

ping @ewindisch @jfrazelle ptal

thanks @qzio!

[jessfraz]

If the ptrace macro exists on 2.8 then we should change the version check,
because as is, right now, this is changing the behavior of the default
profile so NOT LGTM

On Thu, Dec 3, 2015 at 6:52 AM, Sebastiaan van Stijn <
notifications@github.com> wrote:

ping @ewindisch https://github.com/ewindisch @jfrazelle
https://github.com/jfrazelle ptal

thanks @qzio https://github.com/qzio!

—
Reply to this email directly or view it on GitHub
#18393 (comment).

[jessfraz]

will do some testing re different versions

[qzio]

I have not been able to build-and-package locally to actually test this.

However this line works for me using the ubuntu/trusty64 vagrant base box, with docker installed from https://experimental.docker.com

[qzio]

For my use case (using ps inside the container to list that container's processes) the (trace,read) makes no difference.

I do not know enough about apparmor to have an opinion on (trace,read) be or not to be.

[qzio]

I did some more digging and I think this is where that line needs to be.

Adding the line to /etc/apparmor.d/docker is what I want to accomplish.

[jessfraz]

so the problem is this will still break distros like wheezy we need to change the version check to 2.8

[ewindisch]

IIRC, older AppArmor versions can allow ptrace, but not granularly. That
is, you can allow ptrace, but cannot specify a peer or read/write/trace.

On Fri, Dec 4, 2015 at 12:00 PM, Jess Frazelle notifications@github.com
wrote:

In daemon/execdriver/native/apparmor.go
#18393 (comment):

@@ -60,12 +60,13 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) {
deny /sys/firmware/efi/efivars/* rwklx,
deny /sys/kernel/security/* rwklx,

• suppress ptrace denials when using 'docker ps' or using 'ps' inside a container

• ptrace (trace,read) peer=docker-default,

so the problem is this will still break distros like wheezy we need to
change the version check to 2.8

—
Reply to this email directly or view it on GitHub
https://github.com/docker/docker/pull/18393/files#r46704053.

[qzio]

Why the tests fails are beyond my knowledge about apparmor, I don't know how the unloading is done and why this doesn't work.

For ref: The tests past previous when I accidentally pushed a commit with wrong number of {{end}} compared to number of {{if }}

For ref2: The test did not pass when I used one "outer" if that did {{if ge .MajorVersion 2}} and then 2 "inner" if's that did the {{if ge .MinorVersion 8}} and 9.

I've solved my particular problem on my installations by hacking the /etc/init/docker.conf script and adding this line in the post-start section.

Not sure how to fix the tests since even master failed last time I checked.

[qzio]

An other rebase against master seemed to "fix" the tests.

[thaJeztah]

ping @ewindisch @jfrazelle can you have another look?

[jessfraz]

LGTM now thanks