Adolfo Delorenzo
efc7f80b65
Security hardening: bind kubeconfig server to localhost, mount hardening (noexec/nosuid/nodev on tmpfs), sysctl network hardening, kernel module loading lock after boot, SHA256 checksum verification for downloads, kernel AppArmor + Audit support, complain-mode AppArmor profiles for containerd and kubelet, and security integration test. ARM64 Raspberry Pi support: piCore64 base extraction, RPi kernel build from raspberrypi/linux fork, RPi firmware fetch, SD card image with 4- partition GPT and tryboot A/B mechanism, BootEnv Go interface abstracting GRUB vs RPi boot environments, architecture-aware build scripts, QEMU aarch64 dev VM and boot test. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
57 lines
1.3 KiB
Plaintext
57 lines
1.3 KiB
Plaintext
# AppArmor profile for kubesolo (kubelet + control plane)
|
|
# Start in complain mode to log without blocking
|
|
|
|
#include <tunables/global>
|
|
|
|
profile kubesolo /usr/bin/kubesolo flags=(complain) {
|
|
#include <abstractions/base>
|
|
|
|
# Binary and shared libraries
|
|
/usr/bin/kubesolo mr,
|
|
/usr/lib/** mr,
|
|
/lib/** mr,
|
|
|
|
# KubeSolo state (etcd/SQLite, certificates, manifests)
|
|
/var/lib/kubesolo/** rw,
|
|
|
|
# KubeSolo configuration
|
|
/etc/kubesolo/** r,
|
|
|
|
# Containerd socket
|
|
/run/containerd/** rw,
|
|
|
|
# CNI networking
|
|
/etc/cni/** r,
|
|
/opt/cni/bin/** ix,
|
|
|
|
# Proc and sys access
|
|
@{PROC}/** r,
|
|
/sys/** r,
|
|
|
|
# Device access
|
|
/dev/** rw,
|
|
|
|
# Network access (API server, kubelet, etcd)
|
|
network,
|
|
|
|
# Control plane needs broad capabilities
|
|
capability,
|
|
|
|
# Kubectl and other tools
|
|
/usr/bin/kubectl ix,
|
|
/usr/local/bin/** ix,
|
|
|
|
# Temp files
|
|
/tmp/** rw,
|
|
|
|
# Log files
|
|
/var/log/** rw,
|
|
|
|
# Kubelet needs to manage pods
|
|
/var/lib/kubelet/** rw,
|
|
|
|
# Signal handling
|
|
signal,
|
|
ptrace,
|
|
}
|