clearlinux/docker
2
0
Fork 0
mirror of https://github.com/clearlinux/docker.git synced 2026-09-05 05:01:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

AppArmor: Deny w to /proc/* files

Browse Source 
Introduce a write denial for files at the root of /proc.

This prohibits root users from performing a chmod of those
files. The rules for denials in proc are also cleaned up,
making the rules better match their targets.

Locally tested on:
- Ubuntu precise (12.04) with AppArmor 2.7
- Ubuntu trusty (14.04) with AppArmor 2.8.95

Signed-off-by: Eric Windisch <eric@windisch.us>
This commit is contained in:
Eric Windisch
2015-08-13 15:39:25 -04:00
parent 6b1b1ad31c
commit 7342d59114
2 changed files with 13 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
integration-cli/docker_cli_run_test.go
+12
View File
@@ -2811,6 +2811,18 @@ func (s *DockerSuite) TestAppArmorTraceSelf(c *check.C) {
}
}
func (s *DockerSuite) TestAppArmorDeniesChmodProc(c *check.C) {
testRequires(c, SameHostDaemon, NativeExecDriver, Apparmor)
_, exitCode, _ := dockerCmdWithError("run", "busybox", "chmod", "744", "/proc/cpuinfo")
if exitCode == 0 {
// If our test failed, attempt to repair the host system...
_, exitCode, _ := dockerCmdWithError("run", "busybox", "chmod", "444", "/proc/cpuinfo")
if exitCode == 0 {
c.Fatal("AppArmor was unsuccessful in prohibiting chmod of /proc/* files.")
}
}
}
func (s *DockerSuite) TestRunCapAddSYSTIME(c *check.C) {
testRequires(c, NativeExecDriver)