apparmor: allow readby and tracedby

[goldwynr]

Fixes audit errors such as:

type=AVC msg=audit(1550236803.810:143):
apparmor="DENIED" operation="ptrace" profile="docker-default"
pid=3181 comm="ps" requested_mask="readby" denied_mask="readby"
peer="docker-default"

audit(1550236375.918:3): apparmor="DENIED" operation="ptrace"
profile="docker-default" pid=2267 comm="ps"
requested_mask="tracedby" denied_mask="tracedby"
peer="docker-default"

Signed-off-by: Goldwyn Rodrigues rgoldwyn@suse.com

- What I did

- How I did it

- How to verify it

- Description for the changelog

- A picture of a cute animal (not mandatory but encouraged)

[thaJeztah]

ping @justincormack @cyphar PTAL

[cyphar]

Seems reasonable.

[justincormack]

I think maybe the comment should be changed on the line above - these are I think now needed as we allow ptrace which we did not for seccomp reasons before kernel 4.8, and I don't think you would get these just from ps.

[Lekensteyn]

Had a coworker running into the same problem when running ls -l /proc/$pid/fd:

audit[22984]: AVC apparmor="DENIED" operation="ptrace" profile="docker-default" pid=22984 comm="ls" requested_mask="readby" denied_mask="readby" peer="docker-default"

Ubuntu 18.04 with a 4.18.0-17-generic kernel and the following Docker version:

Client:
 Version:           18.09.5
 API version:       1.38 (downgraded from 1.39)
 Go version:        go1.10.8
 Git commit:        e8ff056
 Built:             Thu Apr 11 04:43:57 2019
 OS/Arch:           linux/amd64
 Experimental:      false

Server:
 Engine:
  Version:          18.06.1-ce
  API version:      1.38 (minimum version 1.12)
  Go version:       go1.10.4
  Git commit:       e68fc7a
  Built:            Tue May  7 17:57:34 2019
  OS/Arch:          linux/amd64
  Experimental:     false

Patching the default profile with this tracedby,readby option (and testing it with apparmor_profile -r < new_profile.txt to replace the old profile) ensured that ls -l /proc/$pid/fd, ss -tlpn, lsof -iTCP, etc. work again and show the process name.

The readby option alone should also be sufficient to permit reading procfs, see also https://gitlab.com/apparmor/apparmor/wikis/TechnicalDoc_Proc_and_ptrace#ptrace-rules-for-proc

Documentation for the tracedby and readby settings can be found in the apparmor.d manual:
https://gitlab.com/apparmor/apparmor/blob/master/parser/apparmor.d.pod#L933

[thaJeztah]

ping @goldwynr could you have a look at the review comment?

@justincormack any other issues with this patch, other than the comment?

[goldwynr]

@justincormack Without this patch the "denied "readby" messages are shown for docker ps, though the command succeeds. So, the comment still holds good.

[goldwynr]

ping! could the maintainers review the changes?

[thaJeztah]

LGTM