36 lines
1.3 KiB
Plaintext
Executable File
36 lines
1.3 KiB
Plaintext
Executable File
#include <tunables/global>
|
|
|
|
# AppArmor profile for an LXC container running inside the Coven.
|
|
# File: /etc/apparmor.d/lxc/lxc-sorcery-essence
|
|
#
|
|
# This profile is the "Immutable Vault". It allows containers to READ
|
|
# from the Tomb (to run their software) but strictly forbids WRITING,
|
|
# LINKING, or DELETING. A compromised container cannot poison the
|
|
# global Essence store.
|
|
|
|
profile lxc-sorcery-essence flags=(attach_disconnected, mediate_deleted) {
|
|
#include <abstractions/lxc/container-default>
|
|
|
|
# 1. Global Essence Store Access (READ ONLY)
|
|
# Prevents any container from modifying the master hashes
|
|
/var/lib/sorcery/tomb/ r,
|
|
/var/lib/sorcery/tomb/** r,
|
|
/var/lib/sorcery/essences/ r,
|
|
/var/lib/sorcery/essences/** r,
|
|
|
|
# 2. Deny all write/append/link/rename/delete attempts
|
|
deny /var/lib/sorcery/tomb/** wklx,
|
|
deny /var/lib/sorcery/essences/** wklx,
|
|
|
|
# 3. Allow BoltDB read-only access for local manifest verification
|
|
/var/lib/sorcery/state/state.db r,
|
|
|
|
# 4. Allow the Sorcery-Go engine binary to execute
|
|
/usr/local/bin/sorcery rix,
|
|
/usr/local/bin/warding rix,
|
|
/usr/local/bin/gaze rix,
|
|
|
|
# 5. Allow writes only inside the container's own rootfs
|
|
/var/lib/lxc/*/rootfs/** rwkl,
|
|
}
|