host
eae60cf3d7
- AppArmor network rules must use socket types (stream/dgram), not protocol names (tcp/udp/icmp): the parser rejected the profile (Invalid network entry) until fixed. - Tinyproxy has no 'Upstream none' syntax; the line failed the service at startup. Direct connection is the default, so the line is removed. - Tinyproxy Filter is POSIX BASIC regex, not extended: the extended-style anchored patterns denied even allowed domains (verified: xcmapi.org got 403). Rewritten in basic syntax (\(...\)* groups); the anchored form still blocks evilgithub.com and xcmapi.org.evil.com (verified on host). - Filter file must be world-readable (was 640 root:root, so tinyproxy could not read it and exited on reload); install steps now chmod 644 (documented in the filter header via the install note in tinyproxy.conf). Host already runs these exact files (proxy allow/block verified: xcmapi/github/api.github 200, example/evilgithub/ xcmapi.org.evil.com 403).
76 lines
2.2 KiB
Plaintext
76 lines
2.2 KiB
Plaintext
# AppArmor profile for codex task containers (outer hardening).
|
|
#
|
|
# Based on Docker's default container profile, with stricter denies:
|
|
# - deny network raw: no raw sockets (ping/scan/sniff tricks)
|
|
# - deny ptrace: no process injection / debugging other processes
|
|
# - deny mount/umount: containers must never mount (bwrap path is
|
|
# NOT enabled here; inner sandbox stays danger-full-access by
|
|
# choice, so mount inside the container is pure attack surface)
|
|
# - deny dangerous capabilities (defense in depth; containers also
|
|
# run with --cap-drop=ALL, so these are a second lock, not the
|
|
# only one)
|
|
# - deny writes to /proc/sys, /sys, /proc/keys (kernel tunables)
|
|
#
|
|
# Deliberately NOT included: `userns` (that would enable the bwrap
|
|
# inner-sandbox path, which is a separate decision, not this one).
|
|
#
|
|
# Install: cp to /etc/apparmor.d/docker-codex, then
|
|
# apparmor_parser -r /etc/apparmor.d/docker-codex
|
|
# Use: docker --security-opt apparmor=docker-codex
|
|
# (worker flag: --docker-security-opt apparmor=docker-codex)
|
|
# Verify: docker inspect <container> shows
|
|
# "AppArmorProfile": "docker-codex" (not "docker-default").
|
|
|
|
#include <tunables/global>
|
|
|
|
profile docker-codex flags=(attach_disconnected,mediate_deleted) {
|
|
#include <abstractions/base>
|
|
|
|
network inet stream,
|
|
network inet dgram,
|
|
network inet6 stream,
|
|
network inet6 dgram,
|
|
deny network raw,
|
|
|
|
capability chown,
|
|
capability dac_override,
|
|
capability fsetid,
|
|
capability fowner,
|
|
capability mknod,
|
|
capability net_bind_service,
|
|
capability setfcap,
|
|
capability setgid,
|
|
capability setpcap,
|
|
capability setuid,
|
|
capability sys_chroot,
|
|
deny capability sys_admin,
|
|
deny capability sys_ptrace,
|
|
deny capability net_admin,
|
|
deny capability net_raw,
|
|
deny capability sys_module,
|
|
deny capability sys_rawio,
|
|
deny capability sys_boot,
|
|
deny capability sys_time,
|
|
deny capability mac_admin,
|
|
deny capability mac_override,
|
|
|
|
deny mount,
|
|
deny umount,
|
|
deny pivot_root,
|
|
deny ptrace,
|
|
|
|
file,
|
|
deny @{PROC}/sys/** w,
|
|
deny @{PROC}/sysrq-trigger rw,
|
|
deny @{PROC}/keys/** rw,
|
|
deny @{PROC}/kcore rw,
|
|
deny /sys/** w,
|
|
deny /etc/shadow rw,
|
|
deny /etc/gshadow rw,
|
|
|
|
signal,
|
|
unix,
|
|
dbus,
|
|
ptrace (readby),
|
|
}
|