|
|
@@ -17,32 +17,103 @@ killing processing without logging, verify that auditd is not installed. |
|
|
## Apparmor
|
|
|
|
|
|
The apparmor part is similar to aa-exec -p, i.e. it will launch the application
|
|
|
-under the given apparmor profile.
|
|
|
+under the specified apparmor profile.
|
|
|
|
|
|
|
|
|
## Seccomp
|
|
|
|
|
|
The seccomp filter profile in expected to be located in
|
|
|
`/var/lib/snapd/seccomp/profiles`
|
|
|
|
|
|
-The filter file contains lines with syscall names, comments that start
|
|
|
-with "#" or special directives that start with a "@".
|
|
|
+The filter file contains lines with syscall names, comments that start with "#"
|
|
|
+or special directives that start with a "@". Lines with syscall names may
|
|
|
+optionally specify additional arguments. Eg:
|
|
|
|
|
|
-The supported special directives are:
|
|
|
-@unrestricted
|
|
|
+ RULE = ( <syscall> [ARGS] | DIRECTIVE )
|
|
|
|
|
|
-The unrestricted profile looks like this:
|
|
|
-```
|
|
|
-# Unrestricted profile
|
|
|
-@unrestricted
|
|
|
-```
|
|
|
+ DIRECTIVE = @unrestricted
|
|
|
|
|
|
-A very strict profile might look like this:
|
|
|
-```
|
|
|
-# Super strict profile
|
|
|
-read
|
|
|
-write
|
|
|
-```
|
|
|
+ ARGS = ( - | [CONDITIONAL]VALUE )*
|
|
|
+
|
|
|
+ CONDITIONAL = ( '!', '>', '>=', '<', '<=' )
|
|
|
+
|
|
|
+ VALUE = ( UNSIGNED INT | KEY )
|
|
|
+
|
|
|
+ KEY = ( SOCKET DOMAIN | SOCKET TYPE | PRCTL | PRIO )
|
|
|
+
|
|
|
+ SOCKET DOMAIN = ( AF_UNIX | AF_LOCAL | AF_INET | AF_INET6 | AF_IPX |
|
|
|
+ AF_NETLINK | AF_X25 | AF_AX25 | AF_ATMPVC | AF_APPLETALK | AF_PACKET |
|
|
|
+ AF_ALG | AF_CAN )
|
|
|
+
|
|
|
+ SOCKET TYPE = ( SOCK_STREAM | SOCK_DGRAM | SOCK_SEQPACKET | SOCK_RAW |
|
|
|
+ SOCK_RDM | SOCK_PACKET )
|
|
|
+
|
|
|
+ PRCTL = ( PR_CAP_AMBIENT | PR_CAP_AMBIENT_RAISE |
|
|
|
+ PR_CAP_AMBIENT_LOWER | PR_CAP_AMBIENT_IS_SET |
|
|
|
+ PR_CAP_AMBIENT_CLEAR_ALL | PR_CAPBSET_READ | PR_CAPBSET_DROP |
|
|
|
+ PR_SET_CHILD_SUBREAPER | PR_GET_CHILD_SUBREAPER | PR_SET_DUMPABLE |
|
|
|
+ PR_GET_DUMPABLE | PR_SET_ENDIAN | PR_GET_ENDIAN | PR_SET_FPEMU |
|
|
|
+ PR_GET_FPEMU | PR_SET_FPEXC | PR_GET_FPEXC | PR_SET_KEEPCAPS |
|
|
|
+ PR_GET_KEEPCAPS | PR_MCE_KILL | PR_MCE_KILL_GET | PR_SET_MM |
|
|
|
+ PR_SET_MM_START_CODE | PR_SET_MM_END_CODE | PR_SET_MM_START_DATA |
|
|
|
+ PR_SET_MM_END_DATA | PR_SET_MM_START_STACK | PR_SET_MM_START_BRK |
|
|
|
+ PR_SET_MM_BRK | PR_SET_MM_ARG_START | PR_SET_MM_ARG_END |
|
|
|
+ PR_SET_MM_ENV_START | PR_SET_MM_ENV_END | PR_SET_MM_AUXV |
|
|
|
+ PR_SET_MM_EXE_FILE | PR_MPX_ENABLE_MANAGEMENT |
|
|
|
+ PR_MPX_DISABLE_MANAGEMENT | PR_SET_NAME | PR_GET_NAME |
|
|
|
+ PR_SET_NO_NEW_PRIVS | PR_GET_NO_NEW_PRIVS | PR_SET_PDEATHSIG |
|
|
|
+ PR_GET_PDEATHSIG | PR_SET_PTRACER | PR_SET_SECCOMP | PR_GET_SECCOMP |
|
|
|
+ PR_SET_SECUREBITS | PR_GET_SECUREBITS | PR_SET_THP_DISABLE |
|
|
|
+ PR_TASK_PERF_EVENTS_DISABLE | PR_TASK_PERF_EVENTS_ENABLE |
|
|
|
+ PR_GET_THP_DISABLE | PR_GET_TID_ADDRESS | PR_SET_TIMERSLACK |
|
|
|
+ PR_GET_TIMERSLACK | PR_SET_TIMING | PR_GET_TIMING | PR_SET_TSC |
|
|
|
+ PR_GET_TSC | PR_SET_UNALIGN | PR_GET_UNALIGN )
|
|
|
+
|
|
|
+ PRIO = ( PRIO_PROCESS | PRIO_PGRP | PRIO_USER )
|
|
|
+
|
|
|
+See `man 2 socket` and `man 2 prctl` for details on `SOCKET DOMAIN`,
|
|
|
+`SOCKET TYPE` and `PRCTL`.
|
|
|
+
|
|
|
+Specifying '-' as the argument skips filtering for that argument. Not
|
|
|
+specifying a conditional mean exact match. The syntax is meant to reflect
|
|
|
+how `seccomp_rule_add(3)` is used.
|
|
|
+
|
|
|
+Examples:
|
|
|
+
|
|
|
+* The unrestricted profile looks like this:
|
|
|
+
|
|
|
+ # Unrestricted profile
|
|
|
+ @unrestricted
|
|
|
+
|
|
|
+* A very strict profile might look like this:
|
|
|
+
|
|
|
+ # Super strict profile
|
|
|
+ read
|
|
|
+ write
|
|
|
+
|
|
|
+* Use of seccomp argument filtering:
|
|
|
+
|
|
|
+ # allow any socket types for AF_UNIX and AF_LOCAL
|
|
|
+ socket AF_UNIX
|
|
|
+ socket AF_LOCAL
|
|
|
+
|
|
|
+ # Only allow SOCK_STREAM and SOCK_DGRAM for AF_INET
|
|
|
+ socket AF_INET SOCK_STREAM
|
|
|
+ socket AF_INET SOCK_DGRAM
|
|
|
+
|
|
|
+ # Allow renicing of one's own process (arg2 is '0) to higher nice values
|
|
|
+ setpriority - 0 >=0
|
|
|
+
|
|
|
+ # Allow dropping privileges to uid/gid '1' and raising back again
|
|
|
+ setuid <=1
|
|
|
+ setgid <=1
|
|
|
+ seteuid <=1
|
|
|
+ setegid <=1
|
|
|
+
|
|
|
+Limitations
|
|
|
+ * seccomp argument filtering only allows specifying positive integers as
|
|
|
+ arguments which means you may not dereference pointers, etc.
|
|
|
+ * up to 6 arguments may be specified
|
|
|
|
|
|
|
|
|
## devices cgroup
|
|
|
|
