Merge pull request #47829 from vvoland/v26.1-47749

[26.1 backport] apparmor: Allow confined runc to kill containers
moby · May 14, 2024 · 73511cd · 73511cd
2 parents ef1912d + 76fcf9a
commit 73511cd
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/profiles/apparmor/template.go b/profiles/apparmor/template.go
@@ -25,6 +25,10 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) {
   umount,
   # Host (privileged) processes may send signals to container processes.
   signal (receive) peer=unconfined,
+  # runc may send signals to container processes (for "docker stop").
+  signal (receive) peer=runc,
+  # crun may send signals to container processes (for "docker stop" when used with crun OCI runtime).
+  signal (receive) peer=crun,
   # dockerd may send signals to container processes (for "docker kill").
   signal (receive) peer={{.DaemonProfile}},
   # Container processes may send signals amongst themselves.