apparmor: generate ro,bind,remount rule list

and update to changes based on lxd

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

diff --git a/src/lxc/lsm/apparmor.c b/src/lxc/lsm/apparmor.c
index e34d999a191ce7d86aed4f989bf141b7e1eda8c1..f251e5e7ec4db9b3c0f3036b858de66cf6b10b14 100644 (file)
--- a/src/lxc/lsm/apparmor.c
+++ b/src/lxc/lsm/apparmor.c
@@ -132,6 +132,16 @@ static const char AA_PROFILE_BASE[] =
 "#  mount options=(rw,make-unbindable) -> **,\n"
 "#  mount options=(rw,make-runbindable) -> **,\n"
 "\n"
+"# Allow limited modification of mount propagation\n"
+"  mount options=(rw,make-slave) -> /,\n"
+"  mount options=(rw,make-rslave) -> /,\n"
+"  mount options=(rw,make-shared) -> /,\n"
+"  mount options=(rw,make-rshared) -> /,\n"
+"  mount options=(rw,make-private) -> /,\n"
+"  mount options=(rw,make-rprivate) -> /,\n"
+"  mount options=(rw,make-unbindable) -> /,\n"
+"  mount options=(rw,make-runbindable) -> /,\n"
+"\n"
 "  # allow bind-mounts of anything except /proc, /sys and /dev\n"
 "  mount options=(rw,bind) /[^spd]*{,/**},\n"
 "  mount options=(rw,bind) /d[^e]*{,/**},\n"
@@ -150,15 +160,18 @@ static const char AA_PROFILE_BASE[] =
 "  mount options=(rw,bind) /sy[^s]*{,/**},\n"
 "  mount options=(rw,bind) /sys?*{,/**},\n"
 "\n"
-"  # allow various ro-bind-*re*-mounts\n"
-"  mount options=(ro,remount,bind),\n"
-"  mount options=(ro,remount,bind,nosuid),\n"
-"  mount options=(ro,remount,bind,noexec),\n"
-"  mount options=(ro,remount,bind,nodev),\n"
-"  mount options=(ro,remount,bind,nosuid,noexec),\n"
-"  mount options=(ro,remount,bind,noexec,nodev),\n"
-"  mount options=(ro,remount,bind,nodev,nosuid),\n"
-"  mount options=(ro,remount,bind,nosuid,noexec,nodev),\n"
+"  # Allow rbind-mounts of anything except /, /dev, /proc and /sys\n"
+"  mount options=(rw,rbind) /[^spd]*{,/**},\n"
+"  mount options=(rw,rbind) /d[^e]*{,/**},\n"
+"  mount options=(rw,rbind) /de[^v]*{,/**},\n"
+"  mount options=(rw,rbind) /dev?*{,/**},\n"
+"  mount options=(rw,rbind) /p[^r]*{,/**},\n"
+"  mount options=(rw,rbind) /pr[^o]*{,/**},\n"
+"  mount options=(rw,rbind) /pro[^c]*{,/**},\n"
+"  mount options=(rw,rbind) /proc?*{,/**},\n"
+"  mount options=(rw,rbind) /s[^y]*{,/**},\n"
+"  mount options=(rw,rbind) /sy[^s]*{,/**},\n"
+"  mount options=(rw,rbind) /sys?*{,/**},\n"
 "\n"
 "  # allow moving mounts except for /proc, /sys and /dev\n"
 "  mount options=(rw,move) /[^spd]*{,/**},\n"
@@ -324,12 +337,13 @@ static const char AA_PROFILE_NESTING_BASE[] =
 "\n"
 "  mount fstype=proc -> /usr/lib/*/lxc/**,\n"
 "  mount fstype=sysfs -> /usr/lib/*/lxc/**,\n"
-"  mount options=(rw,bind),\n"
-"  mount options=(rw,rbind),\n"
-"  mount options=(rw,make-rshared),\n"
 "\n"
-   /* FIXME: What's the state here on apparmor's side? */
-"  # there doesn't seem to be a way to ask for:\n"
+"  # Allow nested LXD\n"
+"  mount none -> /var/lib/lxd/shmounts/,\n"
+"  mount /var/lib/lxd/shmounts/ -> /var/lib/lxd/shmounts/,\n"
+"  mount options=bind /var/lib/lxd/shmounts/** -> /var/lib/lxd/**,\n"
+"\n"
+"  # FIXME: There doesn't seem to be a way to ask for:\n"
 "  # mount options=(ro,nosuid,nodev,noexec,remount,bind),\n"
 "  # as we always get mount to $cdir/proc/sys with those flags denied\n"
 "  # So allow all mounts until that is straightened out:\n"
@@ -631,6 +645,86 @@ static bool is_privileged(struct lxc_conf *conf)
        return lxc_list_empty(&conf->id_map);
 }
 
+static const char* AA_ALL_DEST_PATH_LIST[] = {
+       " -> /[^spd]*{,/**},\n",
+       " -> /d[^e]*{,/**},\n",
+       " -> /de[^v]*{,/**},\n",
+       " -> /dev/.[^l]*{,/**},\n",
+       " -> /dev/.l[^x]*{,/**},\n",
+       " -> /dev/.lx[^c]*{,/**},\n",
+       " -> /dev/.lxc?*{,/**},\n",
+       " -> /dev/[^.]*{,/**},\n",
+       " -> /dev?*{,/**},\n",
+       " -> /p[^r]*{,/**},\n",
+       " -> /pr[^o]*{,/**},\n",
+       " -> /pro[^c]*{,/**},\n",
+       " -> /proc?*{,/**},\n",
+       " -> /s[^y]*{,/**},\n",
+       " -> /sy[^s]*{,/**},\n",
+       " -> /sys?*{,/**},\n",
+       NULL,
+};
+
+static const struct mntopt_t {
+       const char *opt;
+       size_t len;
+} REMOUNT_OPTIONS[] = {
+       { ",nodev", sizeof(",nodev")-1 },
+       { ",nosuid", sizeof(",nosuid")-1 },
+       { ",noexec", sizeof(",noexec")-1 },
+};
+
+static void append_remount_rule(char **profile, size_t *size, const char *rule)
+{
+       size_t rule_len = strlen(rule);
+
+       for (const char **dest = AA_ALL_DEST_PATH_LIST; *dest; ++dest) {
+               must_append_sized(profile, size, rule, rule_len);
+               must_append_sized(profile, size, *dest, strlen(*dest));
+       }
+}
+
+static void append_all_remount_rules(char **profile, size_t *size)
+{
+       /*
+        * That's 30, and we add at most:
+        * ",nodev,nosuid,noexec,strictatime -> /dev/.lx[^c]*{,/ **},\ n",
+        * which is anouther ~58, this s hould be enough:
+        */
+       char buf[128] = "  mount options=(ro,remount,bind";
+       const size_t buf_append_pos = strlen(buf);
+
+       const size_t opt_count = ARRAY_SIZE(REMOUNT_OPTIONS);
+       size_t opt_bits;
+
+       must_append_sized(profile, size,
+                         "# allow various ro-bind-*re*mounts\n",
+                         sizeof("# allow various ro-bind-*re*mounts\n")-1);
+
+       for (opt_bits = 0; opt_bits != 1 << opt_count; ++opt_bits) {
+               size_t at = buf_append_pos;
+               unsigned bit = 1;
+               size_t o;
+
+               for (o = 0; o != opt_count; ++o, bit <<= 1) {
+                       if (opt_bits & bit) {
+                               const struct mntopt_t *opt = &REMOUNT_OPTIONS[o];
+                               memcpy(&buf[at], opt->opt, opt->len);
+                               at += opt->len;
+                       }
+               }
+
+               memcpy(&buf[at], ")", sizeof(")"));
+               append_remount_rule(profile, size, buf);
+
+               /* noatime and strictatime don't go together */
+               memcpy(&buf[at], ",noatime)", sizeof(",noatime)"));
+               append_remount_rule(profile, size, buf);
+               memcpy(&buf[at], ",strictatime)", sizeof(",strictatime)"));
+               append_remount_rule(profile, size, buf);
+       }
+}
+
 static char *get_apparmor_profile_content(struct lxc_conf *conf, const char *lxcpath)
 {
        char *profile, *profile_name_full;
@@ -648,6 +742,8 @@ static char *get_apparmor_profile_content(struct lxc_conf *conf, const char *lxc
        must_append_sized(&profile, &size, AA_PROFILE_BASE,
                          STRARRAYLEN(AA_PROFILE_BASE));
 
+       append_all_remount_rules(&profile, &size);
+
        if (aa_supports_unix)
                must_append_sized(&profile, &size, AA_PROFILE_UNIX_SOCKETS,
                                  STRARRAYLEN(AA_PROFILE_UNIX_SOCKETS));