Add apparmor profile for vtpm service #3277
Conversation
|
will fix yetus after review is done. |
There was a problem hiding this comment.
Should we add some document specifying the priviledges/access that this container has? I don't know if we can summarize that in a format which would also make sense as we add limitations for other linuxkit containers and for pillar microservices.
We currently don't have a well-define place to put this; maybe a pkg/vtpm/README.md since it would be overkill to add a pkg/vtpm/docs directory I think.
Meanwhile, let's kick off regression tests.
shjala
force-pushed
the
pkg_vtpm_aa
branch
2 times, most recently
from
8597c5a to
5cadd87
Compare
Signed-off-by: Shahriyar Jalayeri <shahriyar@zededa.com>
Signed-off-by: Shahriyar Jalayeri <shahriyar@zededa.com>
allow loading libraries from "/usr/local/...", this is a rule that is going to be used by other profiles, so add it to the base abstraction to avoid repeated copy of the rule in the individual profiles. Signed-off-by: Shahriyar Jalayeri <shahriyar@zededa.com>
Signed-off-by: Shahriyar Jalayeri <shahriyar@zededa.com>
Signed-off-by: Shahriyar Jalayeri <shahriyar@zededa.com>
vtpm is running as root an in the initial namespace (not in a userns), there is no need to grant it capabilities. Signed-off-by: Shahriyar Jalayeri <shahriyar@zededa.com>
Signed-off-by: Shahriyar Jalayeri <shahriyar@zededa.com>
|
git jitters 😅, closed by accident. |
sure, I will add a table listing all accesses and reason behind each. |
|
@shjala Let me merge this now and you can add the docs later. |
This commit amongst other minor changes, mainly adds apparmor profile for vtpm service and consequently tpm2-tools used by vtpm service.
Confined (sandboxed) vtpm service passed tests from azure-on-eve and eve-tools.