Skip to content

Commit 9f50022

Browse files
ccojocark8s-ci-robot
ccojocar
authored and
k8s-ci-robot
committed
Replace the variance in the apparmor file paths with apparmor variables
Replace the task ID and container ID variance in the apparmor file path. Change-Id: I6395c4faf5f5f3773b87e97287647ba0b3cbb3d2 Signed-off-by: Cosmin Cojocar <ccojocar@google.com>
1 parent 8c87af1 commit 9f50022

File tree

4 files changed

+115
-6
lines changed

4 files changed

+115
-6
lines changed

‎examples/apparmorprofile-sleep.yaml

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,18 +17,42 @@ policy: |2
1717
/proc/@{pid}/cgroup r,
1818
/proc/@{pid}/mounts r,
1919
/proc/@{pid}/setgroups r,
20+
/proc/@{pid}/task/@{tid}/attr r,
21+
/proc/@{pid}/task/@{tid}/attr/apparmor r,
22+
/proc/@{pid}/task/@{tid}/attr/apparmor/current r,
2023
/proc/@{pid}/uid_map r,
2124
/proc/sys/kernel/cap_last_cap r,
2225
/run r,
2326
/sys/module/apparmor/parameters/enabled r,
27+
/var/lib/containers/storage/overlay/*/merged r,
28+
/var/lib/containers/storage/overlay/*/merged/dev r,
29+
/var/lib/containers/storage/overlay/*/merged/etc r,
30+
/var/lib/containers/storage/overlay/*/merged/proc r,
31+
/var/lib/containers/storage/overlay/*/merged/run r,
32+
/var/lib/containers/storage/overlay/*/merged/run/secrets r,
33+
/var/lib/containers/storage/overlay/*/merged/run/secrets/kubernetes.io r,
34+
/var/lib/containers/storage/overlay/*/merged/sys r,
35+
/var/lib/containers/storage/overlay/*/merged/var r,
2436
2537
deny /proc/@{pid}/cgroup wlk,
2638
deny /proc/@{pid}/mounts wlk,
2739
deny /proc/@{pid}/setgroups wlk,
40+
deny /proc/@{pid}/task/@{tid}/attr wlk,
41+
deny /proc/@{pid}/task/@{tid}/attr/apparmor wlk,
42+
deny /proc/@{pid}/task/@{tid}/attr/apparmor/current wlk,
2843
deny /proc/@{pid}/uid_map wlk,
2944
deny /proc/sys/kernel/cap_last_cap wlk,
3045
deny /run wlk,
3146
deny /sys/module/apparmor/parameters/enabled wlk,
47+
deny /var/lib/containers/storage/overlay/*/merged wlk,
48+
deny /var/lib/containers/storage/overlay/*/merged/dev wlk,
49+
deny /var/lib/containers/storage/overlay/*/merged/etc wlk,
50+
deny /var/lib/containers/storage/overlay/*/merged/proc wlk,
51+
deny /var/lib/containers/storage/overlay/*/merged/run wlk,
52+
deny /var/lib/containers/storage/overlay/*/merged/run/secrets wlk,
53+
deny /var/lib/containers/storage/overlay/*/merged/run/secrets/kubernetes.io wlk,
54+
deny /var/lib/containers/storage/overlay/*/merged/sys wlk,
55+
deny /var/lib/containers/storage/overlay/*/merged/var wlk,
3256
3357
3458
/etc/alpine-release wlk,
@@ -84,6 +108,7 @@ policy: |2
84108
/lib/libssl.so.3 wlk,
85109
/lib/libz.so.1.3.1 wlk,
86110
/lib/sysctl.d/00-alpine.conf wlk,
111+
/proc/@{pid}/task/@{tid}/attr/apparmor/exec wlk,
87112
/sbin/apk wlk,
88113
/sbin/ldconfig wlk,
89114
/usr/bin/getconf wlk,
@@ -115,6 +140,9 @@ policy: |2
115140
/usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616ae350.rsa.pub wlk,
116141
/usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616db30d.rsa.pub wlk,
117142
/usr/share/udhcpc/default.script wlk,
143+
/var/lib/containers/storage/overlay/*/merged/dev/termination-log wlk,
144+
/var/lib/containers/storage/overlay/*/merged/etc/resolv.conf wlk,
145+
/var/lib/containers/storage/overlay/*/merged/run/.containerenv wlk,
118146
119147
deny /etc/alpine-release r,
120148
deny /etc/apk/arch r,
@@ -169,6 +197,7 @@ policy: |2
169197
deny /lib/libssl.so.3 r,
170198
deny /lib/libz.so.1.3.1 r,
171199
deny /lib/sysctl.d/00-alpine.conf r,
200+
deny /proc/@{pid}/task/@{tid}/attr/apparmor/exec r,
172201
deny /sbin/apk r,
173202
deny /sbin/ldconfig r,
174203
deny /usr/bin/getconf r,
@@ -200,6 +229,9 @@ policy: |2
200229
deny /usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616ae350.rsa.pub r,
201230
deny /usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616db30d.rsa.pub r,
202231
deny /usr/share/udhcpc/default.script r,
232+
deny /var/lib/containers/storage/overlay/*/merged/dev/termination-log r,
233+
deny /var/lib/containers/storage/overlay/*/merged/etc/resolv.conf r,
234+
deny /var/lib/containers/storage/overlay/*/merged/run/.containerenv r,
203235
204236
205237
/dev/null rwlk,

‎hack/ci/e2e-apparmor.sh

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,6 @@ check_apparmor_profile() {
3030
# clean up the variance in the recorded apparmor profile
3131
yq -i ".spec" $APPARMOR_PROFILE_FILE
3232
sed -i -e "s/\btest-recording_test-pod[^ ]*\b/test-sleep/g" $APPARMOR_PROFILE_FILE
33-
sed -i -e '/\/var\/lib\/containers\/storage\/overlay/d' $APPARMOR_PROFILE_FILE
34-
sed -i -e '/\/proc\/@{pid}\/task/d' $APPARMOR_PROFILE_FILE
3533

3634
diff $APPARMOR_REFERENCE_PROFILE_FILE $APPARMOR_PROFILE_FILE
3735
}

‎internal/pkg/daemon/bpfrecorder/bpfrecorder_apparmor.go

Lines changed: 17 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -52,8 +52,6 @@ var appArmorHooks = []string{
5252
"cap_capable",
5353
}
5454

55-
var pathWithPid *regexp.Regexp = regexp.MustCompile(`^/proc/\d+/`)
56-
5755
// mntnsID is a unique identifier for a group of processes usually running in a container
5856
// Note: on a host running concurrent containers, there will be multiple process running with
5957
// the same PID but they are assigned to different mntns since they run in different containers.
@@ -241,6 +239,22 @@ func (b *AppArmorRecorder) GetAppArmorProcessed(mntns uint32) BpfAppArmorProcess
241239
return processed
242240
}
243241

242+
func replaceVarianceInFilePath(filePath string) string {
243+
filePath = filepath.Clean(filePath)
244+
245+
// Replace PID value with a apparmor variable.
246+
pathWithPid := regexp.MustCompile(`^/proc/\d+/`)
247+
filePath = pathWithPid.ReplaceAllString(filePath, "/proc/@{pid}/")
248+
249+
// Replace TID value with a apparmor variable.
250+
pathWithTid := regexp.MustCompile(`^/proc/@{pid}/task/\d+/`)
251+
filePath = pathWithTid.ReplaceAllString(filePath, "/proc/@{pid}/task/@{tid}/")
252+
253+
// Replace container ID with any container ID
254+
pathWithCid := regexp.MustCompile(`^/var/lib/containers/storage/overlay/\w+/`)
255+
return pathWithCid.ReplaceAllString(filePath, "/var/lib/containers/storage/overlay/*/")
256+
}
257+
244258
func (b *AppArmorRecorder) processExecFsEvents(mid mntnsID) BpfAppArmorFileProcessed {
245259
b.lockRecordedFiles.Lock()
246260
defer b.lockRecordedFiles.Unlock()
@@ -252,8 +266,7 @@ func (b *AppArmorRecorder) processExecFsEvents(mid mntnsID) BpfAppArmorFileProce
252266
}
253267

254268
for fileName, access := range b.recordedFiles[mid] {
255-
fileName = filepath.Clean(fileName)
256-
fileName = pathWithPid.ReplaceAllString(fileName, "/proc/@{pid}/")
269+
fileName = replaceVarianceInFilePath(fileName)
257270

258271
knownLibrary := isKnownFile(fileName, knownLibrariesPrefixes) || fileName == b.programName
259272
knownRead := isKnownFile(fileName, knownReadPrefixes)

‎internal/pkg/daemon/bpfrecorder/bpfrecorder_apparmor_test.go

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
//go:build linux && !no_bpf
2+
// +build linux,!no_bpf
3+
4+
/*
5+
Copyright 2021 The Kubernetes Authors.
6+
7+
Licensed under the Apache License, Version 2.0 (the "License");
8+
you may not use this file except in compliance with the License.
9+
You may obtain a copy of the License at
10+
11+
http://www.apache.org/licenses/LICENSE-2.0
12+
13+
Unless required by applicable law or agreed to in writing, software
14+
distributed under the License is distributed on an "AS IS" BASIS,
15+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16+
See the License for the specific language governing permissions and
17+
limitations under the License.
18+
*/
19+
20+
package bpfrecorder
21+
22+
import (
23+
"testing"
24+
25+
"github.com/stretchr/testify/require"
26+
)
27+
28+
func TestReplaceVarianceInFilePath(t *testing.T) {
29+
t.Parallel()
30+
31+
cases := []struct {
32+
name string
33+
path string
34+
want string
35+
}{
36+
{
37+
name: "no replacement",
38+
path: "/sys/module/apparmor/parameters/enabled",
39+
want: "/sys/module/apparmor/parameters/enabled",
40+
},
41+
{
42+
name: "replace only PID",
43+
path: "/proc/123/cgroup",
44+
want: "/proc/@{pid}/cgroup",
45+
},
46+
{
47+
name: "replace PID and TID",
48+
path: "/proc/123/task/12948/attr/apparmor",
49+
want: "/proc/@{pid}/task/@{tid}/attr/apparmor",
50+
},
51+
{
52+
name: "replace container ID",
53+
path: "/var/lib/containers/storage/overlay/8a0a50ee00/merged/dev",
54+
want: "/var/lib/containers/storage/overlay/*/merged/dev",
55+
},
56+
}
57+
58+
for _, tc := range cases {
59+
tc := tc
60+
t.Run(tc.name, func(t *testing.T) {
61+
t.Parallel()
62+
got := replaceVarianceInFilePath(tc.path)
63+
require.Equal(t, tc.want, got)
64+
})
65+
}
66+
}

0 commit comments

Comments
 (0)