profiles/apparmor: remove version-conditional constraints (< 2.8.96)

thaJeztah · thaJeztah · commit 7008a514493a · 2023-02-08T18:04:04.000+01:00
These conditions were added in 8cf8924 to account for old versions of debian/ubuntu (apparmor_parser < 2.8.96) that lacked some options; > This allows us to use the apparmor profile we have in contrib/apparmor/ > and solves the problems where certain functions are not apparent on older > versions of apparmor_parser on debian/ubuntu. Those patches were from 2015/2016, and all currently supported distro versions should now have more current versions than that. Looking at the oldest supported versions; Ubuntu 18.04 "Bionic": apparmor_parser --version AppArmor parser version 2.12 Copyright (C) 1999-2008 Novell Inc. Copyright 2009-2012 Canonical Ltd. Debian 10 "Buster" apparmor_parser --version AppArmor parser version 2.13.2 Copyright (C) 1999-2008 Novell Inc. Copyright 2009-2018 Canonical Ltd. This patch removes the conditionals. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
diff --git a/profiles/apparmor/template.go b/profiles/apparmor/template.go
@@ -24,14 +24,12 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) {
   capability,
   file,
   umount,
-{{if ge .Version 208096}}
   # Host (privileged) processes may send signals to container processes.
   signal (receive) peer=unconfined,
   # dockerd may send signals to container processes (for "docker kill").
   signal (receive) peer={{.DaemonProfile}},
   # Container processes may send signals amongst themselves.
   signal (send,receive) peer={{.Name}},
-{{end}}
 
   deny @{PROC}/* w,   # deny write for all files directly in /proc (not in a subdir)
   # deny write to files not in /proc/<number>/** or /proc/sys/**
@@ -51,9 +49,7 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) {
   deny /sys/firmware/** rwklx,
   deny /sys/kernel/security/** rwklx,
 
-{{if ge .Version 208095}}
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read,tracedby,readby) peer={{.Name}},
-{{end}}
 }
 `
