From 50f04f626494c2024435ec2b8b3adc6845c1d484 Mon Sep 17 00:00:00 2001 From: "Terence D. Honles" Date: Mon, 4 Nov 2024 16:33:14 +0100 Subject: [PATCH] update apparmor profile to allow podman to send any signal This change updates the default apparmor profile to allow podman to send any signal rather than the allow listed "SIGINT", "SIGQUIT", "SIGKILL", and "SIGTERM". This fixes podman with signal proxying turned on (``--sig-proxy``) not being able to forward signals from the terminal such as "SIGWINCH" when attached to a TTY. Signed-off-by: Terence Honles --- pkg/apparmor/apparmor_linux_template.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/apparmor/apparmor_linux_template.go b/pkg/apparmor/apparmor_linux_template.go index 48707521f..8f2baa72e 100644 --- a/pkg/apparmor/apparmor_linux_template.go +++ b/pkg/apparmor/apparmor_linux_template.go @@ -24,7 +24,7 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) { # Allow certain signals from OCI runtimes (podman, runc and crun) signal (receive) peer={/usr/bin/,/usr/sbin/,}runc, signal (receive) peer={/usr/bin/,/usr/sbin/,}crun*, - signal (receive) set=(int, quit, kill, term) peer={/usr/bin/,/usr/sbin/,}podman, + signal (receive) peer={/usr/bin/,/usr/sbin/,}podman, {{end}} deny @{PROC}/* w, # deny write for all files directly in /proc (not in a subdir)