File bsc1073877-0001-apparmor-allow-receiving-of-sig... of Package docker

Overview Repositories Revisions Requests Users Attributes Meta

File bsc1073877-0001-apparmor-allow-receiving-of-signals-from-docker-kill.patch of Package docker (Revision ce0106136b840c75a2581ba3034e0c02)

Currently displaying revision ce0106136b840c75a2581ba3034e0c02 , Show latest

From fb59d17b2617ebee34f91786428f63571a19bb74 Mon Sep 17 00:00:00 2001
From: Aleksa Sarai <asarai@suse.de>
Date: Sun, 8 Apr 2018 20:21:30 +1000
Subject: [PATCH] apparmor: allow receiving of signals from 'docker kill'

In newer kernels, AppArmor will reject attempts to send signals to a
container because the signal originated from outside of that AppArmor
profile. Correct this by allowing all unconfined signals to be received.

SUSE-Bugs: bsc#1073877 boo#1089732
Signed-off-by: Goldwyn Rodrigues <rgoldwyn@suse.com>
Signed-off-by: Aleksa Sarai <asarai@suse.de>
---
 components/engine/profiles/apparmor/template.go | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/components/engine/profiles/apparmor/template.go b/components/engine/profiles/apparmor/template.go
index c5ea4584de6b..47c1b0659a15 100644
--- a/components/engine/profiles/apparmor/template.go
+++ b/components/engine/profiles/apparmor/template.go
@@ -17,6 +17,10 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) {
   capability,
   file,
   umount,
+{{if ge .Version 208096}}
+{{/* Allow 'docker kill' to actually send signals to container processes. */}}
+  signal (receive) peer=unconfined,
+{{end}}
 
   deny @{PROC}/* w,   # deny write for all files directly in /proc (not in a subdir)
   # deny write to files not in /proc/<number>/** or /proc/sys/**
-- 
2.16.3

Places

File bsc1073877-0001-apparmor-allow-receiving-of-signals-from-docker-kill.patch of Package docker (Revision ce0106136b840c75a2581ba3034e0c02)

Places