contrib/apparmor: deny /sys/devices/virtual/powercap

neersighted · neersighted · commit 02f07fe1994a · 2023-09-18T17:02:26.000-06:00
While this is not strictly necessary as the default OCI config masks this path, it is possible that the user disabled path masking, passed their own list, or is using a forked (or future) daemon version that has a modified default config/allows changing the default config. Add some defense-in-depth by also masking out this problematic hardware device with the AppArmor LSM. Signed-off-by: Bjorn Neergaard <bjorn.neergaard@docker.com> (cherry picked from commit 6c6dfcb) Signed-off-by: Bjorn Neergaard <bjorn.neergaard@docker.com>
diff --git a/contrib/apparmor/template.go b/contrib/apparmor/template.go
@@ -81,6 +81,7 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) {
   deny /sys/fs/c[^g]*/** wklx,
   deny /sys/fs/cg[^r]*/** wklx,
   deny /sys/firmware/** rwklx,
+  deny /sys/devices/virtual/powercap/** rwklx,
   deny /sys/kernel/security/** rwklx,
 
 {{if ge .Version 208095}}
