Merge pull request #47830 from vvoland/v25.0-47749

[25.0 backport] apparmor: Allow confined runc to kill containers
moby · May 15, 2024 · 577ca9b · 577ca9b
2 parents 03ecc6f + 98ddccb
commit 577ca9b
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/profiles/apparmor/template.go b/profiles/apparmor/template.go
@@ -25,6 +25,10 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) {
   umount,
   # Host (privileged) processes may send signals to container processes.
   signal (receive) peer=unconfined,
+  # runc may send signals to container processes (for "docker stop").
+  signal (receive) peer=runc,
+  # crun may send signals to container processes (for "docker stop" when used with crun OCI runtime).
+  signal (receive) peer=crun,
   # dockerd may send signals to container processes (for "docker kill").
   signal (receive) peer={{.DaemonProfile}},
   # Container processes may send signals amongst themselves.