Join GitHub today
GitHub is home to over 20 million developers working together to host and review code, manage projects, and build software together.
interfaces: apparmor support for classic confinement #2366
Conversation
zyga
added some commits
Nov 28, 2016
All checks have passed
mvo5
merged commit 4a53918
into
snapcore:master
Nov 29, 2016
zyga
deleted the
zyga:classic-confinement-apparmor
branch
Nov 29, 2016
| @@ -145,7 +145,7 @@ func (b *Backend) combineSnippets(snapInfo *snap.Info, opts interfaces.Confineme | ||
| func addContent(securityTag string, snapInfo *snap.Info, opts interfaces.ConfinementOptions, snippets map[string][][]byte, content map[string]*osutil.FileState) { | ||
| policy := defaultTemplate | ||
| - if opts.DevMode && !opts.JailMode { | ||
| + if (opts.DevMode || opts.Classic) && !opts.JailMode { | ||
| policy = attachPattern.ReplaceAll(policy, attachComplain) |
jdstrand
Nov 29, 2016
•
Edited 1 time
-
jdstrand
Nov 29, 2016
Contributor
Edited 1 time
-
Nov 29, 2016
classic shouldn't complain-- you'll get a ton of syslog entries when the snap is legitimately running in classic. Instead please generate a different profile. Eg:
$ cat /var/lib/snapd/apparmor/profiles/snap.iam.classic
#include <tunables/global>
@{SNAP_NAME}="iam"
@{SNAP_REVISION}="x1"
@{INSTALL_DIR}="/snap"
# use complain to future-proof if we missed something
profile "snap.iam.classic" (attach_disconnected,complain) {
# set file rules so that exec() inherit our profile unless there is
# already a profile for it (eg, snap-confine)
/ rwkl,
/** rwlkm,
/** pix,
capability,
change_profile,
dbus,
network,
mount,
remount,
umount,
pivot_root,
ptrace,
signal,
unix,
}
jdstrand
Nov 29, 2016
Contributor
Alternatively, keep the template but add interfaces/builtin/classic.go with the above rules (and keep ',complain'). classic.go could also use '@unrestricted' for seccomp. The potential downside is this approach makes 'classic' show up in 'snap interfaces'.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
zyga commentedNov 28, 2016
This simple branch adds apparmor support for classic confinement. In classic confinement (when
interfaces.ConfinementOptions{Classic: true}) apparmor is in non-enforcing mode. As with devmode, usingJailModeflag forces the enforcing confinement.