Adolfo Delorenzo
efc7f80b65
Security hardening: bind kubeconfig server to localhost, mount hardening (noexec/nosuid/nodev on tmpfs), sysctl network hardening, kernel module loading lock after boot, SHA256 checksum verification for downloads, kernel AppArmor + Audit support, complain-mode AppArmor profiles for containerd and kubelet, and security integration test. ARM64 Raspberry Pi support: piCore64 base extraction, RPi kernel build from raspberrypi/linux fork, RPi firmware fetch, SD card image with 4- partition GPT and tryboot A/B mechanism, BootEnv Go interface abstracting GRUB vs RPi boot environments, architecture-aware build scripts, QEMU aarch64 dev VM and boot test. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
53 lines
1.3 KiB
Plaintext
53 lines
1.3 KiB
Plaintext
# AppArmor profile for containerd
|
|
# Start in complain mode to log without blocking
|
|
|
|
#include <tunables/global>
|
|
|
|
profile containerd /usr/bin/containerd flags=(complain) {
|
|
#include <abstractions/base>
|
|
|
|
# Binary and shared libraries
|
|
/usr/bin/containerd mr,
|
|
/usr/lib/** mr,
|
|
/lib/** mr,
|
|
|
|
# Containerd runtime state
|
|
/var/lib/containerd/** rw,
|
|
/run/containerd/** rw,
|
|
|
|
# Container image layers and snapshots
|
|
/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/** rw,
|
|
|
|
# CNI networking
|
|
/etc/cni/** r,
|
|
/opt/cni/bin/** ix,
|
|
|
|
# Proc and sys access for containers
|
|
@{PROC}/** r,
|
|
/sys/** r,
|
|
|
|
# Device access for containers
|
|
/dev/** rw,
|
|
|
|
# Network access
|
|
network,
|
|
|
|
# Container runtime needs broad capabilities
|
|
capability,
|
|
|
|
# Allow executing container runtimes
|
|
/usr/bin/containerd-shim-runc-v2 ix,
|
|
/usr/bin/runc ix,
|
|
/usr/sbin/runc ix,
|
|
|
|
# Temp files
|
|
/tmp/** rw,
|
|
|
|
# Log files
|
|
/var/log/** rw,
|
|
|
|
# Signal handling for child processes
|
|
signal,
|
|
ptrace,
|
|
}
|