From cb4189a292dc181e26e0506a3a0dc67936c5401b Mon Sep 17 00:00:00 2001 From: "Guillaume J. Charmes" Date: Wed, 5 Mar 2014 11:59:31 -0800 Subject: [PATCH 1/3] Add AppArmor support to native driver + change pipe/dup logic Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes (github: creack) --- execdriver/native/default_template.go | 4 +++ pkg/libcontainer/apparmor/apparmor.go | 42 +++++++++++++++++++++++++++ pkg/libcontainer/container.go | 3 +- pkg/libcontainer/nsinit/init.go | 22 ++++++++------ 4 files changed, 61 insertions(+), 10 deletions(-) create mode 100644 pkg/libcontainer/apparmor/apparmor.go diff --git a/execdriver/native/default_template.go b/execdriver/native/default_template.go index 8e06ff2e2..3458b2efc 100644 --- a/execdriver/native/default_template.go +++ b/execdriver/native/default_template.go @@ -37,6 +37,7 @@ func createContainer(c *execdriver.Command) *libcontainer.Container { if c.Privileged { container.Capabilities = nil container.Cgroups.DeviceAccess = true + container.Context["apparmor_profile"] = "unconfined" } if c.Resources != nil { container.Cgroups.CpuShares = c.Resources.CpuShares @@ -78,5 +79,8 @@ func getDefaultTemplate() *libcontainer.Container { Parent: "docker", DeviceAccess: false, }, + Context: libcontainer.Context{ + "apparmor_profile": "lxc-container-default", + }, } } diff --git a/pkg/libcontainer/apparmor/apparmor.go b/pkg/libcontainer/apparmor/apparmor.go new file mode 100644 index 000000000..044b7661a --- /dev/null +++ b/pkg/libcontainer/apparmor/apparmor.go @@ -0,0 +1,42 @@ +package apparmor + +import ( + "errors" + "fmt" + "io/ioutil" + "log" + "os" +) + +var AppArmorEnabled bool + +var ( + ErrAppArmorDisabled = errors.New("Error: AppArmor is not enabled on this system") +) + +func init() { + buf, err := ioutil.ReadFile("/sys/module/apparmor/parameters/enabled") + AppArmorEnabled = err == nil && len(buf) > 1 && buf[0] == 'Y' +} + +func ApplyProfile(pid int, name string) error { + if !AppArmorEnabled { + return ErrAppArmorDisabled + } + + f, err := os.OpenFile(fmt.Sprintf("/proc/%d/attr/current", pid), os.O_WRONLY, 0) + if err != nil { + log.Printf("error open: %s\n", err) + return err + } + defer f.Close() + + if _, err := fmt.Fprintf(f, "changeprofile %s", name); err != nil { + log.Printf("changeprofile %s", name) + log.Printf("Error write: %s\n", err) + return err + } else { + log.Printf("Write success!") + } + return nil +} diff --git a/pkg/libcontainer/container.go b/pkg/libcontainer/container.go index 12a3d7ba8..bd16825d9 100644 --- a/pkg/libcontainer/container.go +++ b/pkg/libcontainer/container.go @@ -20,7 +20,8 @@ type Container struct { Namespaces Namespaces `json:"namespaces,omitempty"` // namespaces to apply Capabilities Capabilities `json:"capabilities,omitempty"` // capabilities to drop Networks []*Network `json:"networks,omitempty"` // nil for host's network stack - Cgroups *cgroups.Cgroup `json:"cgroups,omitempty"` + Cgroups *cgroups.Cgroup `json:"cgroups,omitempty"` // cgroups + Context Context `json:"context,omitempty"` // generic context for specific options (apparmor, selinux) } // Network defines configuration for a container's networking stack diff --git a/pkg/libcontainer/nsinit/init.go b/pkg/libcontainer/nsinit/init.go index 565030f25..48d9213ad 100644 --- a/pkg/libcontainer/nsinit/init.go +++ b/pkg/libcontainer/nsinit/init.go @@ -5,6 +5,7 @@ package nsinit import ( "fmt" "github.com/dotcloud/docker/pkg/libcontainer" + "github.com/dotcloud/docker/pkg/libcontainer/apparmor" "github.com/dotcloud/docker/pkg/libcontainer/capabilities" "github.com/dotcloud/docker/pkg/libcontainer/network" "github.com/dotcloud/docker/pkg/libcontainer/utils" @@ -32,7 +33,7 @@ func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, consol if console != "" { // close pipes so that we can replace it with the pty - closeStdPipes() + // closeStdPipes() slave, err := system.OpenTerminal(console, syscall.O_RDWR) if err != nil { return fmt.Errorf("open terminal %s", err) @@ -55,9 +56,17 @@ func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, consol return fmt.Errorf("parent death signal %s", err) } */ + if err := setupNewMountNamespace(rootfs, console, container.ReadonlyFs); err != nil { return fmt.Errorf("setup mount namespace %s", err) } + + if err := apparmor.ApplyProfile(os.Getpid(), container.Context["apparmor_profile"]); err != nil { + if err != apparmor.ErrAppArmorDisabled { + return err + } + } + if err := setupNetwork(container, context); err != nil { return fmt.Errorf("setup networking %s", err) } @@ -67,13 +76,8 @@ func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, consol if err := finalizeNamespace(container); err != nil { return fmt.Errorf("finalize namespace %s", err) } - return system.Execv(args[0], args[0:], container.Env) -} -func closeStdPipes() { - os.Stdin.Close() - os.Stdout.Close() - os.Stderr.Close() + return system.Execv(args[0], args[0:], container.Env) } func setupUser(container *libcontainer.Container) error { @@ -109,8 +113,8 @@ func setupUser(container *libcontainer.Container) error { // dupSlave dup2 the pty slave's fd into stdout and stdin and ensures that // the slave's fd is 0, or stdin func dupSlave(slave *os.File) error { - if slave.Fd() != 0 { - return fmt.Errorf("slave fd not 0 %d", slave.Fd()) + if err := system.Dup2(slave.Fd(), 0); err != nil { + return err } if err := system.Dup2(slave.Fd(), 1); err != nil { return err From 37f137c8221be07943babeb9b107e5aee9a736d5 Mon Sep 17 00:00:00 2001 From: Michael Crosby Date: Wed, 5 Mar 2014 12:27:31 -0800 Subject: [PATCH 2/3] Some cleanup around logs Docker-DCO-1.1-Signed-off-by: Michael Crosby (github: crosbymichael) --- pkg/libcontainer/apparmor/apparmor.go | 21 ++++----------------- pkg/libcontainer/nsinit/init.go | 14 +++++--------- 2 files changed, 9 insertions(+), 26 deletions(-) diff --git a/pkg/libcontainer/apparmor/apparmor.go b/pkg/libcontainer/apparmor/apparmor.go index 044b7661a..4b1bf579f 100644 --- a/pkg/libcontainer/apparmor/apparmor.go +++ b/pkg/libcontainer/apparmor/apparmor.go @@ -1,42 +1,29 @@ package apparmor import ( - "errors" "fmt" "io/ioutil" - "log" "os" ) -var AppArmorEnabled bool - -var ( - ErrAppArmorDisabled = errors.New("Error: AppArmor is not enabled on this system") -) - -func init() { +func IsEnabled() bool { buf, err := ioutil.ReadFile("/sys/module/apparmor/parameters/enabled") - AppArmorEnabled = err == nil && len(buf) > 1 && buf[0] == 'Y' + return err == nil && len(buf) > 1 && buf[0] == 'Y' } func ApplyProfile(pid int, name string) error { - if !AppArmorEnabled { - return ErrAppArmorDisabled + if !IsEnabled() || name == "" { + return nil } f, err := os.OpenFile(fmt.Sprintf("/proc/%d/attr/current", pid), os.O_WRONLY, 0) if err != nil { - log.Printf("error open: %s\n", err) return err } defer f.Close() if _, err := fmt.Fprintf(f, "changeprofile %s", name); err != nil { - log.Printf("changeprofile %s", name) - log.Printf("Error write: %s\n", err) return err - } else { - log.Printf("Write success!") } return nil } diff --git a/pkg/libcontainer/nsinit/init.go b/pkg/libcontainer/nsinit/init.go index 48d9213ad..a854f130e 100644 --- a/pkg/libcontainer/nsinit/init.go +++ b/pkg/libcontainer/nsinit/init.go @@ -32,8 +32,6 @@ func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, consol syncPipe.Close() if console != "" { - // close pipes so that we can replace it with the pty - // closeStdPipes() slave, err := system.OpenTerminal(console, syscall.O_RDWR) if err != nil { return fmt.Errorf("open terminal %s", err) @@ -51,10 +49,10 @@ func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, consol } } - /* - if err := system.ParentDeathSignal(); err != nil { - return fmt.Errorf("parent death signal %s", err) - } + /* this is commented out so that we get the current Ghost functionality + if err := system.ParentDeathSignal(); err != nil { + return fmt.Errorf("parent death signal %s", err) + } */ if err := setupNewMountNamespace(rootfs, console, container.ReadonlyFs); err != nil { @@ -62,9 +60,7 @@ func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, consol } if err := apparmor.ApplyProfile(os.Getpid(), container.Context["apparmor_profile"]); err != nil { - if err != apparmor.ErrAppArmorDisabled { - return err - } + return err } if err := setupNetwork(container, context); err != nil { From 920a6ca54ce98673d0c9a6a9502a469c1c225c75 Mon Sep 17 00:00:00 2001 From: "Guillaume J. Charmes" Date: Wed, 5 Mar 2014 14:57:20 -0800 Subject: [PATCH 3/3] Generate and load custom docker profile for apparmor Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes (github: creack) --- execdriver/native/default_template.go | 2 +- execdriver/native/driver.go | 4 ++ pkg/libcontainer/apparmor/setup.go | 98 +++++++++++++++++++++++++++ 3 files changed, 103 insertions(+), 1 deletion(-) create mode 100644 pkg/libcontainer/apparmor/setup.go diff --git a/execdriver/native/default_template.go b/execdriver/native/default_template.go index 3458b2efc..e86a99f02 100644 --- a/execdriver/native/default_template.go +++ b/execdriver/native/default_template.go @@ -80,7 +80,7 @@ func getDefaultTemplate() *libcontainer.Container { DeviceAccess: false, }, Context: libcontainer.Context{ - "apparmor_profile": "lxc-container-default", + "apparmor_profile": "docker-default", }, } } diff --git a/execdriver/native/driver.go b/execdriver/native/driver.go index e53b06fba..e7a722f46 100644 --- a/execdriver/native/driver.go +++ b/execdriver/native/driver.go @@ -6,6 +6,7 @@ import ( "github.com/dotcloud/docker/execdriver" "github.com/dotcloud/docker/pkg/cgroups" "github.com/dotcloud/docker/pkg/libcontainer" + "github.com/dotcloud/docker/pkg/libcontainer/apparmor" "github.com/dotcloud/docker/pkg/libcontainer/nsinit" "github.com/dotcloud/docker/pkg/system" "io/ioutil" @@ -62,6 +63,9 @@ func NewDriver(root string) (*driver, error) { if err := os.MkdirAll(root, 0700); err != nil { return nil, err } + if err := apparmor.InstallDefaultProfile(); err != nil { + return nil, err + } return &driver{ root: root, }, nil diff --git a/pkg/libcontainer/apparmor/setup.go b/pkg/libcontainer/apparmor/setup.go new file mode 100644 index 000000000..fda810b44 --- /dev/null +++ b/pkg/libcontainer/apparmor/setup.go @@ -0,0 +1,98 @@ +package apparmor + +import ( + "fmt" + "io/ioutil" + "os" + "os/exec" +) + +const DefaultProfilePath = "/etc/apparmor.d/docker" +const DefaultProfile = ` +# AppArmor profile from lxc for containers. +@{HOME}=@{HOMEDIRS}/*/ /root/ +@{HOMEDIRS}=/home/ +#@{HOMEDIRS}+= +@{multiarch}=*-linux-gnu* +@{PROC}=/proc/ + +profile docker-default flags=(attach_disconnected,mediate_deleted) { + network, + capability, + file, + umount, + dbus, + + # ignore DENIED message on / remount + deny mount options=(ro, remount) -> /, + + # allow tmpfs mounts everywhere + mount fstype=tmpfs, + + # allow mqueue mounts everywhere + mount fstype=mqueue, + + # allow fuse mounts everywhere + mount fstype=fuse.*, + + # allow bind mount of /lib/init/fstab for lxcguest + mount options=(rw, bind) /lib/init/fstab.lxc/ -> /lib/init/fstab/, + + # deny writes in /proc/sys/fs but allow binfmt_misc to be mounted + mount fstype=binfmt_misc -> /proc/sys/fs/binfmt_misc/, + deny @{PROC}/sys/fs/** wklx, + + # allow efivars to be mounted, writing to it will be blocked though + mount fstype=efivarfs -> /sys/firmware/efi/efivars/, + + # block some other dangerous paths + deny @{PROC}/sysrq-trigger rwklx, + deny @{PROC}/mem rwklx, + deny @{PROC}/kmem rwklx, + deny @{PROC}/sys/kernel/[^s][^h][^m]* wklx, + deny @{PROC}/sys/kernel/*/** wklx, + + # deny writes in /sys except for /sys/fs/cgroup, also allow + # fusectl, securityfs and debugfs to be mounted there (read-only) + mount fstype=fusectl -> /sys/fs/fuse/connections/, + mount fstype=securityfs -> /sys/kernel/security/, + mount fstype=debugfs -> /sys/kernel/debug/, + deny mount fstype=debugfs -> /var/lib/ureadahead/debugfs/, + mount fstype=proc -> /proc/, + mount fstype=sysfs -> /sys/, + deny /sys/[^f]*/** wklx, + deny /sys/f[^s]*/** wklx, + deny /sys/fs/[^c]*/** wklx, + deny /sys/fs/c[^g]*/** wklx, + deny /sys/fs/cg[^r]*/** wklx, + deny /sys/firmware/efi/efivars/** rwklx, + deny /sys/kernel/security/** rwklx, + mount options=(move) /sys/fs/cgroup/cgmanager/ -> /sys/fs/cgroup/cgmanager.lower/, + + # the container may never be allowed to mount devpts. If it does, it + # will remount the host's devpts. We could allow it to do it with + # the newinstance option (but, right now, we don't). + deny mount fstype=devpts, +} +` + +func InstallDefaultProfile() error { + if !IsEnabled() { + return nil + } + + // If the profile already exists, let it be. + if _, err := os.Stat(DefaultProfilePath); err == nil { + return nil + } + + if err := ioutil.WriteFile(DefaultProfilePath, []byte(DefaultProfile), 0644); err != nil { + return err + } + + output, err := exec.Command("/lib/init/apparmor-profile-load", "docker").CombinedOutput() + if err != nil { + return fmt.Errorf("Error loading docker profile: %s (%s)", err, output) + } + return nil +}