Slide 155
Slide 155 text
@arafkarsh arafkarsh
Linux Sample AppArmour Profile
155
#include
profile docker-nginx
flags=(attach_disconnected,medi
ate_deleted) {
#include
network inet stream,
network inet6 stream,
deny network raw,
deny /etc/ssh/* w,
deny /etc/passwd w,
deny /etc/shadow w,
deny /etc/group w,
owner /var/log/nginx/* rw,
owner /var/lib/nginx/* rw,
/usr/sbin/nginx ix,
deny /var/lib/docker/** w,
deny /proc/*/mount rw,
deny /proc/*/mnt rw,
deny /proc/*/mounts r,
capability net_bind_service,
file,
pivot_root,
umount,
deny /bin/** ix,
deny /sbin/** ix,
deny /usr/bin/** ix,
deny /usr/sbin/** ix,
audit deny @{PROC}/{*,**^[0-
9*],sys/kernel/shm*} rwklx,
audit deny @{PROC}/{sysrq-
trigger,mem,kcore,kmem} rwklx,
deny mount,
deny /etc/grub.d/** r,
deny /etc/lilo.conf r,
deny /boot/grub/menu.lst r,
}
This profile includes the following rules:
• Allows the Nginx server to create network
connections.
• Denies raw socket access, which can be used for
low-level network attacks.
• Denies write access to sensitive system files such
as /etc/passwd.
• Allows the Nginx server to read and write its own
log files and other necessary files.
• Denies write access to Docker's own files.
• Prevents the container from viewing or altering
mount points.
• Allows the container to bind to network ports <
1024.
• Denies execution of binaries except for
/usr/sbin/nginx.
• Denies access to sensitive locations in the /proc
filesystem.
• Denies ability to mount filesystems.
• Denies read access to boot loader configuration
files