starred/windmill
1
0
Fork 0
mirror of https://github.com/windmill-labs/windmill.git synced 2026-10-13 00:03:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: rebase the apparmor profile on the current runtime default

Browse Source
This commit is contained in:
Ruben Fiszel
2026-10-06 11:40:35 +02:00
parent 94c3166a7f
commit 14bc0f172c
2 changed files with 22 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
examples/deploy/nsjail-security-profiles/README.md
+1 -3
View File
@@ -10,7 +10,7 @@ The two profiles here are the runtime defaults with only what nsjail needs added
| File | Purpose |
| --- | --- |
| `windmill-nsjail.seccomp.json` | Docker's default seccomp profile plus `clone` with namespace flags, `mount`, `umount2`, `pivot_root` and `sethostname` |
| `windmill-nsjail.apparmor` | The runtime default AppArmor profile with `deny mount` replaced by `mount`, `umount` and `pivot_root` rules |
| `windmill-nsjail.apparmor` | The [runtime default AppArmor profile](https://github.com/moby/profiles/blob/main/apparmor/template.go) with `deny mount` replaced by `mount`, `umount` and `pivot_root` rules; every other rule, including the denied socket families, is kept |
| `kubernetes-user-namespaces.yaml` | Worker pod settings with no added capability (`hostUsers: false`, `procMount: Unmasked`) |
| `kubernetes-sys-admin.yaml` | Worker pod settings for clusters without user namespaces (`SYS_ADMIN`) |
| `generate-seccomp.py` | Rebuilds the seccomp profile from a newer Docker default |
@@ -28,8 +28,6 @@ sudo install -m 0644 windmill-nsjail.apparmor /etc/apparmor.d/windmill-nsjail
sudo apparmor_parser -r /etc/apparmor.d/windmill-nsjail
```
If the node's audit log shows AppArmor denying `userns_create` for the worker, uncomment the `userns,` rule in the profile (it needs AppArmor 4.0 or later, older parsers reject it) and reload it.
A pod that references a profile missing from its node fails to start, so node groups that autoscale need these steps in their bootstrap or in a DaemonSet. On nodes without AppArmor, remove the `appArmorProfile` block from the pod settings.
## Using the profiles with Docker
examples/deploy/nsjail-security-profiles/windmill-nsjail.apparmor
+21 -7
View File
@@ -1,12 +1,30 @@
#include <tunables/global>
# The container runtimes' default profile (docker-default,
# cri-containerd.apparmor.d) with its blanket "deny mount" replaced by the
# mount, umount and pivot_root rules nsjail needs to build a job's filesystem.
#
# The ABI is pinned to 3.0 as in the runtime default: from ABI 4.0, "network"
# stops covering unix sockets and user namespace creation becomes mediated.
abi <abi/3.0>,
#include <tunables/global>
profile windmill-nsjail flags=(attach_disconnected,mediate_deleted) {
#include <abstractions/base>
network,
deny network ax25,
deny network ipx,
deny network appletalk,
deny network netrom,
deny network rose,
deny network econet,
deny network atmsvc,
deny network irda,
deny network wanpipe,
deny network isdn,
deny network caif,
deny network alg,
deny network vsock,
capability,
file,
@@ -14,10 +32,6 @@ profile windmill-nsjail flags=(attach_disconnected,mediate_deleted) {
umount,
pivot_root,
# Needed where AppArmor mediates user namespace creation for this profile.
# AppArmor parsers older than 4.0 reject the rule, hence commented out.
# userns,
signal (receive) peer=unconfined,
signal (receive) peer=runc,
signal (receive) peer=crun,
@@ -25,7 +39,7 @@ profile windmill-nsjail flags=(attach_disconnected,mediate_deleted) {
signal (send,receive) peer=windmill-nsjail,
deny @{PROC}/* w,
deny @{PROC}/{[^1-9],[^1-9][^0-9],[^1-9s][^0-9y][^0-9s],[^1-9][^0-9][^0-9][^0-9/]*}/** w,
deny @{PROC}/{[^1-9/],[^1-9/][^0-9/],[^1-9s/][^0-9y/][^0-9s/],[^1-9/][^0-9/][^0-9/][^0-9/]*}/** w,
deny @{PROC}/sys/[^k]** w,
deny @{PROC}/sys/kernel/{?,??,[^s][^h][^m]**} w,
deny @{PROC}/sysrq-trigger rwklx,