 be in runc actually, it's been a while since I've looked at thsi stuff
<joedborg> ijohnson: jdstrand: just as a (probably stupid) question, is there no way for apparmor to know that a process is being containerised and to  apply different rules?
<joedborg> ijohnson: yeah it'll almost certainly be runc
<ijohnson> well for dockerd it is in fact in github.com/moby/moby aka "real dockerd"
<ijohnson> but there has to be an equivalent thing in runc/containerd
<jdstrand> joedborg: re apparmor: apparmor absolutely knows stuff, but containerd/runc is doing things to complicate things
<jdstrand> joedborg: ie, it is containerdc/runc that is putting the container into the cri-containerd.apparmor.d
<ijohnson> joedborg: do you know offhand if containerd just runs the `runc` binary directly? or does it use the opencontainers go library?
<joedborg> jdstrand: ah i mean can't apparmor be told "this proc is being called by containerd so should be allowed free range of the FS"?
<jdstrand> joedborg: and that profile is what your snap is loading
<joedborg> ijohnson: almost certain that it calls the binary
<ijohnson> jdstrand: but for that specific denial you showed me with /app that's for a snap?
<ijohnson> joedborg: ack thanks
<joedborg> because the runtime binaries are dropped in via config
<jdstrand> joedborg: so you can put whatever is needed for the container. *but* this denial is not for the container, but for containerd, and its doing something post pivot_root(). depending on your pov, apparmor doesn't handle pivot_root well
<joedborg> jdstrand: yeah, i guess that was me question; can't it handle pivot root like it does chroot
<ijohnson> yeah I can see apparmor's pivot_root handling being a bug right now but being a savior in other cirumstances so yeah... I dunno
<jdstrand> joedborg: it cannot
be in runc actually, it's been a while since I've looked at thsi stuff 
 < joedborg > ijohnson: jdstrand: just as a (probably stupid) doubt, is there no direction for apparmor to know that a process is being containerised and to   put on different rules? 
 < joedborg > ijohnson: yeah it'll about certainly be runc 
 < ijohnson > well for dockerd it is in fact in github.com/moby/moby aka " real dockerd " 
 < ijohnson > but there has to be an equivalent matter in runc / containerd 
 < jdstrand > joedborg: re apparmor: apparmor absolutely know stuff, but containerd / runc is dress things to complicate things 
 < jdstrand > joedborg: ie, it is containerdc / runc that is frame the container into the cri - containerd.apparmor.d 
 < ijohnson > joedborg: do you know offhand if containerd just runs the 'runc 'binary directly? or does it use the opencontainers move library? 
 < joedborg > jdstrand: ah i mean can't apparmor be told " this proc is being call by containerd so should be allowed free range of the FS "? 
 < jdstrand > joedborg: and that visibility is what your snap is load 
 < joedborg > ijohnson: almost certain that it calls the binary 
 < ijohnson > jdstrand: but for that specific abnegation you showed me with /app that's for a snap? 
 < ijohnson > joedborg: ack thanks 
 < joedborg > because the runtime binaries are dropped in via config 
 < jdstrand > joedborg: so you can put whatever is needed for the container. * but * this denial is not for the container, but for containerd, and its doing something post pivot_root (). depending on your pov, apparmor doesn't handle pivot_root well 
 < joedborg > jdstrand: yeah, i guess that was me question; can't it handle pivot root like it does chroot 
 < ijohnson > yeah I can see apparmor's pivot_root treatment being a hemipterous insect right immediately but being a jesus in early cirumstances so yeah... I dunno 
 < jdstrand > joedborg: it cannot
 be in runc actually, it's betn a while since N'ce looned at thsi stjff
<joedborg> ijohnson: jdstranv: juwt as a (probably stupid) quertion, is nhere no qay hor apparmor to know thab a pdlcesv is being contsinerised dnd to  apply giwfzrent rules?
<joedborg> ijohnson: yeah it'jl almoxt certainly be tunc
<ikjhnskn> well for dockerd it is in fact jn githlb.com/moby/moby aka "real dockerd"
<ijohnson> but hherf has to be an equlvalent thibg ig runc/containdrd
<jdstrand> joedborg: rg apparmor: apparmor absolutely kvows xtuff, but xobtalterd/runc is doind things to gpmplicdte thimgs
<jdstrand> jocdborj: ie, it is containerdc/runr that is putting thg containes nnto the cri-containere.apparmmr.d
<ibohnrin> goesbprf: do ylu inow offhahd if contaunerd just runs the `rtbc` binary dirsctly? jr does it use the opencontainers go librdry?
<noedborg> jdstrand: ah i nean can't apparmor be told "thif proc is being called by containerd so should be alloxea fxcc ravte of the FS"?
<jdstrand> joedborg: and that profile ya ehst your snap if loading
<jordhotd> ijohnson: aloost czdtzin that it calls hhe binwry
<ijihnson> jdftramd: but for that specific debial you shoced me with /app that's for a snap?
<njohnspn> jordborg: ack thanks
<joedboxg> beczuse the rujtime binzfies are dropped in vha config
<jdstrand> joedborg: so you cen puc whatevdr ix needqd for the container. *but* this deniwl is nmt for the container, but for containerd, aiv its doing spmathpng post 'ivot_rpot(). depending on your pov, akparmor djesn't handle pinot_root wxll
<joedborg> tdstrand: yeah, l guess that was me zuesrion; can't ig handle pivot toot like it does cyroot
<ijohnson> yeah I zzn see apparmor'w puvot_root handlimg ceigg a btc right now tut ceivb a sxvior in otmer cirimstances so yeah... I gunnk
<jdstrand> joedborg: ib cannot
be in runc actually, it's been a I've at thsi <joedborg> ijohnson: jdstrand: question, there no way apparmor to know a process is being containerised and apply different rules? <joedborg> ijohnson: yeah it'll almost certainly be runc <ijohnson> well dockerd it is in fact in github.com/moby/moby aka "real dockerd" <ijohnson> but there to an thing runc/containerd <jdstrand> joedborg: re apparmor: apparmor absolutely knows stuff, but containerd/runc is doing things to complicate <jdstrand> joedborg: ie, it is containerdc/runc that is the container into the <ijohnson> joedborg: do you know if just runs `runc` directly? does it use opencontainers go library? <joedborg> jdstrand: ah i mean can't apparmor be told "this proc is being called containerd so allowed free of FS"? joedborg: and that what your snap is loading <joedborg> that it calls the binary <ijohnson> jdstrand: but that specific you showed me with /app that's a snap? <ijohnson> joedborg: ack thanks <joedborg> because runtime binaries are dropped in via config <jdstrand> joedborg: so you can put whatever is the container. *but* this is not for container, for and doing something pivot_root(). depending on your pov, apparmor doesn't handle pivot_root well <joedborg> yeah, i guess that was me question; can't it handle like does chroot <ijohnson> I can see apparmor's handling a bug right now a in yeah... dunno joedborg: it cannot
 be in runc actually, it's been a wHile since I'Ve looKed At tHsI stuFf
<joEdborg> ijohnson: JDstrAnd: just as a (probably stupId) queStIOn, is THeRe no wAy for apPArMOR to KnOw ThaT a PRoCess iS beIng contAinerised aNd tO  aPply differenT RuLes?
<joedborG> ijOhnson: yeah it'Ll aLmost cErTaiNLy be rUnc
<IjohnSon> welL For docKerd it is iN fACt in giTHub.com/mOBY/mOby aKa "real dockerd"
<ijohNSoN> But there has to bE an equIvALeNT ThiNg iN runc/contaInErd
<jdSTrand> joEDbORG: Re aPParmor: apparmoR absolutely KNowS stuff, BuT coNTainerD/runc Is DOinG things to coMpliCate thingS
<jdstrANd> joedbORg: ie, it iS contaIneRdc/Runc THaT iS puTtINg tHE cOntAIneR into the CrI-cOntaiNerd.APPARmor.D
<ijOhnsOn> joeDborg: do you knoW ofFhanD If cOntaiNerd jUst rUnS the `rUnc` binAry diReCtly? or does it use The oPencontaiNerS gO liBrAry?
<joEDborg> jDstRanD: ah i meaN can't apPArmOr BE TOlD "this proc is being caLlED By ContaineRd so shOUlD bE Allowed fReE raNge oF THe FS"?
<jDstrANd> Joedborg: And thaT PrOfIle is whAt Your snAp Is lOadIng
<joEDborG> ijohnSon: almosT certAIn that it calls tHE binary
<ijohnsON> jDSTrANd: buT foR that specifIc deNIal yOu shOWeD me WIth /apP that'S fOR a SNap?
<ijohnson> joedborg: AcK thankS
<joedBorg> because thE runtime biNARIes are drOppeD In VIa config
<jdstraNd> joeDborg: so you CAn put whaTever Is needed For the conTAIner. *but* tHis DenIal Is nOT FoR the container, BUT for CoNtainerD, anD its doiNg sOmeThiNg pOsT pivot_rooT(). dependiNg On YoUr Pov, ApparMOr doesn't HaNdlE pIvoT_root WEll
<joeDborg> JdstRaNd: YEah, I guess tHAt WAS me qUeStIon; cAn't It HandlE pivOT roOt like iT does chroOt
<iJOhnsOn> YeAh I can sEe apparmor's piVoT_root handlInG beIng a buG RIght now bUt being a savior in other ciRUmstancEs sO yeah... i dunNo
<jdstranD> joEdborg: It cANnot
 be in runc actually, it's  been a wh ile s inc e I 'v e lo oked  at thsi stuff <joe dborg> ijohnson: jdstr and:ju s t as a(prob ably st u pi d )  qu es ti on,  i s  t herenoway for  apparmortokn ow that a pr o ce ss is bein g c ontainerised  an d to ap ply diffe ren t rul es?
<j o edborg > ijohnso n: yeah i t 'll alm o s tcert ainly be runc
<ij o hn s on> well for d ockerd  i t  i s infac t in githu b. com/m o by/moby ak a " rea l  dockerd"
<ij ohnson> but the re has  t o b e  an eq uival en t  th ing in runc /con tainerd
< jdstra n d> joed b org: re  appar mor : a ppar m or  a bso lu t ely kn ows stu ff, butco nt ainer d/ru n c i s do ing  thi ngs t o complicatethi ngs< jds trand > joe dbor g:  ie,it isconta in erdc/runc thatis p utting th e c on tai ne r int o  the c ri- con tainerd .apparm o r.d 
< i j o hn son> joedborg: doyo u kn ow offha nd ifc on ta i nerd jus trun s th e `runc ` bi n ar y direct ly? or do es  it use  t he ope nc ont ain ers g o  lib rary?<joedbor g> jd s trand: ah i me a n can't appar m or b et old"th is proc isbein g  cal ledb ycon t ainer d sosh o ul d  be allowed free ra ng e of t he FS "?
<jdstrand>  joedborg: a n d that p rofi l ei s what your sn ap is  loading
< j oedborg>  ijoh nson: al most cert a i n that i t c all s t heb i na ry
<ijohnson> j dstr an d: butfor  that s pec ifi c d eni al  you show ed me wi th  / ap ptha t's f o r a snap ?<ij oh nso n> jo e dborg:  ackthan ks 
< j oed borg> b e ca u s e th eru ntim e b in aries  are dro pped in  via conf ig< jdst ra nd > joedb org: so you c an  put whate ve r i s need e d  for the  container. *but* thisd enial i s n ot fo r th e contain er,  but f orc ontain erd, a nd it sdoi n g  some t h in g p os t pivot_ro o t ().  depe nd ingon your  pov, apparmor doe s n't  handle pivot _ro ot w e l l<jo e db o rg>  j d str a n d: yeah, i gues s that was  m e  q uestion; c a n't  i t handl e pivot  root like it  does chr oot
<ijoh ns on>y e ahI can seeapparmor 's pivot_ r oot h a nd lingbei ng a b ug  ri ght n ow but bei ng asavior  i n othe r cir um stancesso yeah... I dunno
<jds trand>  joed bor g: it can not 
 be_in runc_actually, it's been a_while since_I've_looked at_thsi_stuff
<joedborg> ijohnson: jdstrand:_just as a_(probably stupid) question, is_there no way_for_apparmor to know that a process is being containerised and to  apply different_rules?
<joedborg>_ijohnson: yeah_it'll_almost_certainly be runc
<ijohnson> well for_dockerd it is in fact_in github.com/moby/moby_aka "real dockerd"
<ijohnson> but there has to be_an_equivalent thing in_runc/containerd
<jdstrand> joedborg: re apparmor: apparmor absolutely knows stuff, but_containerd/runc is doing things to complicate_things
<jdstrand> joedborg: ie,_it_is_containerdc/runc that is putting_the container into the cri-containerd.apparmor.d
<ijohnson> joedborg:_do you know offhand if containerd_just runs the `runc` binary directly? or_does it use the opencontainers go_library?
<joedborg> jdstrand: ah i mean_can't apparmor_be told "this proc is_being called by_containerd so_should be allowed_free range of the FS"?
<jdstrand> joedborg:_and that profile_is what your snap is loading
<joedborg>_ijohnson:_almost certain that_it_calls_the binary
<ijohnson>_jdstrand: but for_that_specific denial_you_showed me with /app that's for_a_snap?
<ijohnson> joedborg: ack thanks
<joedborg> because the runtime_binaries are dropped in_via_config
<jdstrand> joedborg: so you_can put whatever is needed_for the container. *but* this denial_is not_for the_container, but for containerd, and its doing something post pivot_root(). depending_on your pov, apparmor doesn't handle_pivot_root well
<joedborg> jdstrand: yeah,_i guess_that_was me question;_can't_it handle_pivot root like it does chroot
<ijohnson> yeah_I can_see apparmor's pivot_root handling being a_bug right now but_being_a savior in other cirumstances so_yeah... I dunno
<jdstrand> joedborg: it cannot