Browse code
linux: Use AppArmor security module by default
Docker can use AppArmor profiles to tighten the security of
containers. For example, it can prevent "escape to host" attacks by
restricting access to proc and sys filesystems inside the container.
The kernel-side support for AppArmor is already enabled; make it the
default security module.
Change-Id: Ie69210d7ba2a1e41e5a9d79936470b3201c7cd79
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/5345
Tested-by: gerrit-photon <photon-checkins@vmware.com>
Reviewed-by: Alexey Makhalov <amakhalov@vmware.com>
Reviewed-by: Srivatsa S. Bhat <srivatsab@vmware.com>
Srivatsa S. Bhat authored on 2018/07/12 08:28:21Showing 2 changed files
| ... | ... |
@@ -4252,9 +4252,9 @@ CONFIG_INTEGRITY_AUDIT=y |
| 4252 | 4252 |
# CONFIG_EVM is not set |
| 4253 | 4253 |
# CONFIG_DEFAULT_SECURITY_SELINUX is not set |
| 4254 | 4254 |
# CONFIG_DEFAULT_SECURITY_SMACK is not set |
| 4255 |
-# CONFIG_DEFAULT_SECURITY_APPARMOR is not set |
|
| 4256 |
-CONFIG_DEFAULT_SECURITY_DAC=y |
|
| 4257 |
-CONFIG_DEFAULT_SECURITY="" |
|
| 4255 |
+CONFIG_DEFAULT_SECURITY_APPARMOR=y |
|
| 4256 |
+# CONFIG_DEFAULT_SECURITY_DAC is not set |
|
| 4257 |
+CONFIG_DEFAULT_SECURITY="apparmor" |
|
| 4258 | 4258 |
CONFIG_XOR_BLOCKS=m |
| 4259 | 4259 |
CONFIG_ASYNC_CORE=m |
| 4260 | 4260 |
CONFIG_ASYNC_MEMCPY=m |
| ... | ... |
@@ -2,7 +2,7 @@ |
| 2 | 2 |
Summary: Kernel |
| 3 | 3 |
Name: linux |
| 4 | 4 |
Version: 4.4.139 |
| 5 |
-Release: 2%{?kat_build:.%kat_build}%{?dist}
|
|
| 5 |
+Release: 3%{?kat_build:.%kat_build}%{?dist}
|
|
| 6 | 6 |
License: GPLv2 |
| 7 | 7 |
URL: http://www.kernel.org/ |
| 8 | 8 |
Group: System Environment/Kernel |
| ... | ... |
@@ -547,6 +547,8 @@ ln -sf %{name}-%{uname_r}.cfg /boot/photon.cfg
|
| 547 | 547 |
/usr/share/perf-core |
| 548 | 548 |
|
| 549 | 549 |
%changelog |
| 550 |
+* Wed Jul 11 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.4.139-3 |
|
| 551 |
+- Use AppArmor security module by default. |
|
| 550 | 552 |
* Tue Jul 10 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.4.139-2 |
| 551 | 553 |
- Fix CVE-2017-18232 and CVE-2018-10323. |
| 552 | 554 |
* Tue Jul 03 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.4.139-1 |