[lxc-devel] [lxc/master] apparmor: generate ro, bind, remount rule list
Blub on Github
lxc-bot at linuxcontainers.org
Wed Apr 1 07:30:55 UTC 2020
A non-text attachment was scrubbed...
Name: not available
Type: text/x-mailbox
Size: 396 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20200401/738f521a/attachment.bin>
-------------- next part --------------
From 03876523e48bfd72bc228adb5450521a0259b35b Mon Sep 17 00:00:00 2001
From: Wolfgang Bumiller <w.bumiller at proxmox.com>
Date: Fri, 2 Aug 2019 12:57:42 +0200
Subject: [PATCH] apparmor: generate ro,bind,remount rule list
and update to changes based on lxd
Signed-off-by: Wolfgang Bumiller <w.bumiller at proxmox.com>
---
src/lxc/lsm/apparmor.c | 124 ++++++++++++++++++++++++++++++++++++-----
1 file changed, 110 insertions(+), 14 deletions(-)
diff --git a/src/lxc/lsm/apparmor.c b/src/lxc/lsm/apparmor.c
index e34d999a19..49952198b7 100644
--- a/src/lxc/lsm/apparmor.c
+++ b/src/lxc/lsm/apparmor.c
@@ -132,6 +132,16 @@ static const char AA_PROFILE_BASE[] =
"# mount options=(rw,make-unbindable) -> **,\n"
"# mount options=(rw,make-runbindable) -> **,\n"
"\n"
+"# Allow limited modification of mount propagation\n"
+" mount options=(rw,make-slave) -> /,\n"
+" mount options=(rw,make-rslave) -> /,\n"
+" mount options=(rw,make-shared) -> /,\n"
+" mount options=(rw,make-rshared) -> /,\n"
+" mount options=(rw,make-private) -> /,\n"
+" mount options=(rw,make-rprivate) -> /,\n"
+" mount options=(rw,make-unbindable) -> /,\n"
+" mount options=(rw,make-runbindable) -> /,\n"
+"\n"
" # allow bind-mounts of anything except /proc, /sys and /dev\n"
" mount options=(rw,bind) /[^spd]*{,/**},\n"
" mount options=(rw,bind) /d[^e]*{,/**},\n"
@@ -150,15 +160,18 @@ static const char AA_PROFILE_BASE[] =
" mount options=(rw,bind) /sy[^s]*{,/**},\n"
" mount options=(rw,bind) /sys?*{,/**},\n"
"\n"
-" # allow various ro-bind-*re*-mounts\n"
-" mount options=(ro,remount,bind),\n"
-" mount options=(ro,remount,bind,nosuid),\n"
-" mount options=(ro,remount,bind,noexec),\n"
-" mount options=(ro,remount,bind,nodev),\n"
-" mount options=(ro,remount,bind,nosuid,noexec),\n"
-" mount options=(ro,remount,bind,noexec,nodev),\n"
-" mount options=(ro,remount,bind,nodev,nosuid),\n"
-" mount options=(ro,remount,bind,nosuid,noexec,nodev),\n"
+" # Allow rbind-mounts of anything except /, /dev, /proc and /sys\n"
+" mount options=(rw,rbind) /[^spd]*{,/**},\n"
+" mount options=(rw,rbind) /d[^e]*{,/**},\n"
+" mount options=(rw,rbind) /de[^v]*{,/**},\n"
+" mount options=(rw,rbind) /dev?*{,/**},\n"
+" mount options=(rw,rbind) /p[^r]*{,/**},\n"
+" mount options=(rw,rbind) /pr[^o]*{,/**},\n"
+" mount options=(rw,rbind) /pro[^c]*{,/**},\n"
+" mount options=(rw,rbind) /proc?*{,/**},\n"
+" mount options=(rw,rbind) /s[^y]*{,/**},\n"
+" mount options=(rw,rbind) /sy[^s]*{,/**},\n"
+" mount options=(rw,rbind) /sys?*{,/**},\n"
"\n"
" # allow moving mounts except for /proc, /sys and /dev\n"
" mount options=(rw,move) /[^spd]*{,/**},\n"
@@ -324,12 +337,13 @@ static const char AA_PROFILE_NESTING_BASE[] =
"\n"
" mount fstype=proc -> /usr/lib/*/lxc/**,\n"
" mount fstype=sysfs -> /usr/lib/*/lxc/**,\n"
-" mount options=(rw,bind),\n"
-" mount options=(rw,rbind),\n"
-" mount options=(rw,make-rshared),\n"
"\n"
- /* FIXME: What's the state here on apparmor's side? */
-" # there doesn't seem to be a way to ask for:\n"
+" # Allow nested LXD\n"
+" mount none -> /var/lib/lxd/shmounts/,\n"
+" mount /var/lib/lxd/shmounts/ -> /var/lib/lxd/shmounts/,\n"
+" mount options=bind /var/lib/lxd/shmounts/** -> /var/lib/lxd/**,\n"
+"\n"
+" # FIXME: There doesn't seem to be a way to ask for:\n"
" # mount options=(ro,nosuid,nodev,noexec,remount,bind),\n"
" # as we always get mount to $cdir/proc/sys with those flags denied\n"
" # So allow all mounts until that is straightened out:\n"
@@ -631,6 +645,86 @@ static bool is_privileged(struct lxc_conf *conf)
return lxc_list_empty(&conf->id_map);
}
+static const char* AA_ALL_DEST_PATH_LIST[] = {
+ " -> /[^spd]*{,/**},\n",
+ " -> /d[^e]*{,/**},\n",
+ " -> /de[^v]*{,/**},\n",
+ " -> /dev/.[^l]*{,/**},\n",
+ " -> /dev/.l[^x]*{,/**},\n",
+ " -> /dev/.lx[^c]*{,/**},\n",
+ " -> /dev/.lxc?*{,/**},\n",
+ " -> /dev/[^.]*{,/**},\n",
+ " -> /dev?*{,/**},\n",
+ " -> /p[^r]*{,/**},\n",
+ " -> /pr[^o]*{,/**},\n",
+ " -> /pro[^c]*{,/**},\n",
+ " -> /proc?*{,/**},\n",
+ " -> /s[^y]*{,/**},\n",
+ " -> /sy[^s]*{,/**},\n",
+ " -> /sys?*{,/**},\n",
+ NULL,
+};
+
+static const struct mntopt_t {
+ const char *opt;
+ size_t len;
+} REMOUNT_OPTIONS[] = {
+ { ",nodev", sizeof(",nodev")-1 },
+ { ",nosuid", sizeof(",nosuid")-1 },
+ { ",noexec", sizeof(",noexec")-1 },
+};
+
+static void append_remount_rule(char **profile, size_t *size, const char *rule)
+{
+ size_t rule_len = strlen(rule);
+
+ for (const char **dest = AA_ALL_DEST_PATH_LIST; *dest; ++dest) {
+ must_append_sized(profile, size, rule, rule_len);
+ must_append_sized(profile, size, *dest, strlen(*dest));
+ }
+}
+
+static void append_all_remount_rules(char **profile, size_t *size)
+{
+ /*
+ * That's 30, and we add at most:
+ * ",nodev,nosuid,noexec,strictatime -> /dev/.lx[^c]*{,/**},\n",
+ * which is anouther ~58, this s hould be enough:
+ */
+ char buf[128] = " mount options=(ro,remount,bind";
+ const size_t buf_append_pos = strlen(buf);
+
+ const size_t opt_count = ARRAY_SIZE(REMOUNT_OPTIONS);
+ size_t opt_bits;
+
+ must_append_sized(profile, size,
+ "# allow various ro-bind-*re*mounts\n",
+ sizeof("# allow various ro-bind-*re*mounts\n")-1);
+
+ for (opt_bits = 0; opt_bits != 1 << opt_count; ++opt_bits) {
+ size_t at = buf_append_pos;
+ unsigned bit = 1;
+ size_t o;
+
+ for (o = 0; o != opt_count; ++o, bit <<= 1) {
+ if (opt_bits & bit) {
+ const struct mntopt_t *opt = &REMOUNT_OPTIONS[o];
+ memcpy(&buf[at], opt->opt, opt->len);
+ at += opt->len;
+ }
+ }
+
+ memcpy(&buf[at], ")", sizeof(")"));
+ append_remount_rule(profile, size, buf);
+
+ /* noatime and strictatime don't go together */
+ memcpy(&buf[at], ",noatime)", sizeof(",noatime)"));
+ append_remount_rule(profile, size, buf);
+ memcpy(&buf[at], ",strictatime)", sizeof(",strictatime)"));
+ append_remount_rule(profile, size, buf);
+ }
+}
+
static char *get_apparmor_profile_content(struct lxc_conf *conf, const char *lxcpath)
{
char *profile, *profile_name_full;
@@ -648,6 +742,8 @@ static char *get_apparmor_profile_content(struct lxc_conf *conf, const char *lxc
must_append_sized(&profile, &size, AA_PROFILE_BASE,
STRARRAYLEN(AA_PROFILE_BASE));
+ append_all_remount_rules(&profile, &size);
+
if (aa_supports_unix)
must_append_sized(&profile, &size, AA_PROFILE_UNIX_SOCKETS,
STRARRAYLEN(AA_PROFILE_UNIX_SOCKETS));
More information about the lxc-devel
mailing list