diff --git a/pkg/apparmor/apparmor_linux_template.go b/pkg/apparmor/apparmor_linux_template.go index b8212542d..387707c05 100644 --- a/pkg/apparmor/apparmor_linux_template.go +++ b/pkg/apparmor/apparmor_linux_template.go @@ -21,6 +21,10 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) { # Allow signals from privileged profiles and from within the same profile signal (receive) peer=unconfined, signal (send,receive) peer={{.Name}}, + # Allow certain signals from OCI runtimes (podman, runc and crun) + signal (receive) peer={/usr/bin/,/usr/sbin/,}runc, + signal (receive) peer={/usr/bin/,/usr/sbin/,}crun, + signal (receive) set=(int, quit, kill, term) peer={/usr/bin/,/usr/sbin/,}podman, {{end}} deny @{PROC}/* w, # deny write for all files directly in /proc (not in a subdir)