Create AppArmor profile for operator

deploy/base/kustomization.yaml

@@ -25,6 +25,7 @@ configMapGenerator:
   - name: security-profiles-operator-profile
     files:
       - profiles/security-profiles-operator.json
+      - profiles/security-profiles-operator.apparmor
 
 generatorOptions:
   disableNameSuffixHash: true

deploy/base/operator.yaml

@@ -14,11 +14,13 @@ spec:
         openshift.io/scc: privileged
         seccomp.security.alpha.kubernetes.io/pod: runtime/default
         container.seccomp.security.alpha.kubernetes.io/security-profiles-operator: localhost/security-profiles-operator.json
+        container.apparmor.security.beta.kubernetes.io/security-profiles-operator: localhost/k8s-security-profiles-operator
       labels:
         name: security-profiles-operator
     spec:
       serviceAccountName: security-profiles-operator
       initContainers:
+        # TODO: review security mode for non-root-enabler
         - name: non-root-enabler
           image: bash
           # Creates folder /var/lib/security-profiles-operator, sets 2000:2000 as its
@@ -41,7 +43,12 @@ spec:
               fi
 
               /bin/chown -R 2000:2000 $OPERATOR_ROOT
-              cp -f -v /opt/seccomp-profiles/* $KUBELET_SECCOMP_ROOT
+              cp -f -v /opt/operator-profiles/* $KUBELET_SECCOMP_ROOT
+
+              # TODO: decide on a good way to run apparmor_parser
+              command -v apparmor_parser >/dev/null 2>&1 && \
+                apparmor_parser -r /opt/operator-profiles/security-profiles-operator.apparmor || \
+                echo "failed to execute apparmor_parser, profile won't be loaded onto node"
           env:
             - name: KUBELET_SECCOMP_ROOT
               value: /var/lib/kubelet/seccomp
@@ -53,7 +60,7 @@ spec:
             - name: host-varlib-volume
               mountPath: /var/lib
             - name: profile-configmap-volume
-              mountPath: /opt/seccomp-profiles
+              mountPath: /opt/operator-profiles
               readOnly: true
           securityContext:
             allowPrivilegeEscalation: false

deploy/base/profiles/security-profiles-operator.apparmor

@@ -0,0 +1,56 @@
+#include <tunables/global>
+
+profile k8s-security-profiles-operator /security-profiles-operator flags=(complain) {
+    #include <abstractions/base>
+
+    deny capability net_raw,
+
+    network inet stream,
+    network inet6 stream,
+
+    deny network inet udp,
+    deny network inet icmp,
+    deny network raw,
+    deny network netlink raw,
+    deny network packet,
+
+    file,
+
+    /security-profiles-operator ix,
+
+    /proc/sys/net/core/somaxconn r,
+    /sys/kernel/mm/transparent_hugepage/hpage_pmd_size r,
+
+    # Read service account token
+    /var/run/secrets/kubernetes.io/serviceaccount/** r,
+
+    # Read and write profiles
+    /var/lib/kubelet/seccomp/** rw,
+    /var/lib/security-profiles-operator/** rw,
+
+    # TODO:
+    # deny sensitive files within kubelet folder
+
+    deny /bin/** wl,
+    deny /boot/** wl,
+    deny /dev/** wl,
+    deny /etc/** wl,
+    deny /home/** wl,
+    deny /lib/** wl,
+    deny /lib64/** wl,
+    deny /media/** wl,
+    deny /mnt/** wl,
+    deny /opt/** wl,
+    deny /proc/** wl,
+    deny /root/** wl,
+    deny /sbin/** wl,
+    deny /srv/** wl,
+    deny /tmp/** wl,
+    deny /sys/** wl,
+    deny /usr/** wl,
+
+    deny /bin/bash mrwklx,
+    deny /bin/sh mrwklx,
+
+    deny mount,
+}

deploy/namespace-operator.yaml

@@ -501,7 +501,12 @@ spec:
           fi
 
           /bin/chown -R 2000:2000 $OPERATOR_ROOT
-          cp -f -v /opt/seccomp-profiles/* $KUBELET_SECCOMP_ROOT
+          cp -f -v /opt/operator-profiles/* $KUBELET_SECCOMP_ROOT
+
+          # TODO: decide on a good way to run apparmor_parser
+          command -v apparmor_parser >/dev/null 2>&1 && \
+            apparmor_parser -r /opt/operator-profiles/security-profiles-operator.apparmor || \
+            echo "failed to execute apparmor_parser, profile won't be loaded onto node"
         command:
         - bash
         - -c
@@ -540,7 +545,7 @@ spec:
         volumeMounts:
         - mountPath: /var/lib
           name: host-varlib-volume
-        - mountPath: /opt/seccomp-profiles
+        - mountPath: /opt/operator-profiles
           name: profile-configmap-volume
           readOnly: true
       nodeSelector:
@@ -567,6 +572,63 @@ spec:
 ---
 apiVersion: v1
 data:
+  security-profiles-operator.apparmor: |
+    #include <tunables/global>
+
+    profile k8s-security-profiles-operator /security-profiles-operator flags=(complain) {
+        #include <abstractions/base>
+
+        deny capability net_raw,
+
+        network inet stream,
+        network inet6 stream,
+
+        deny network inet udp,
+        deny network inet icmp,
+        deny network raw,
+        deny network netlink raw,
+        deny network packet,
+
+        file,
+
+        /security-profiles-operator ix,
+
+        /proc/sys/net/core/somaxconn r,
+        /sys/kernel/mm/transparent_hugepage/hpage_pmd_size r,
+
+        # Read service account token
+        /var/run/secrets/kubernetes.io/serviceaccount/** r,
+
+        # Read and write profiles
+        /var/lib/kubelet/seccomp/** rw,
+        /var/lib/security-profiles-operator/** rw,
+
+        # TODO:
+        # deny sensitive files within kubelet folder
+
+        deny /bin/** wl,
+        deny /boot/** wl,
+        deny /dev/** wl,
+        deny /etc/** wl,
+        deny /home/** wl,
+        deny /lib/** wl,
+        deny /lib64/** wl,
+        deny /media/** wl,
+        deny /mnt/** wl,
+        deny /opt/** wl,
+        deny /proc/** wl,
+        deny /root/** wl,
+        deny /sbin/** wl,
+        deny /srv/** wl,
+        deny /tmp/** wl,
+        deny /sys/** wl,
+        deny /usr/** wl,
+
+        deny /bin/bash mrwklx,
+        deny /bin/sh mrwklx,
+
+        deny mount,
+    }
   security-profiles-operator.json: |
     {
       "defaultAction": "SCMP_ACT_ERRNO",

deploy/operator.yaml

@@ -499,7 +499,12 @@ spec:
           fi
 
           /bin/chown -R 2000:2000 $OPERATOR_ROOT
-          cp -f -v /opt/seccomp-profiles/* $KUBELET_SECCOMP_ROOT
+          cp -f -v /opt/operator-profiles/* $KUBELET_SECCOMP_ROOT
+
+          # TODO: decide on a good way to run apparmor_parser
+          command -v apparmor_parser >/dev/null 2>&1 && \
+            apparmor_parser -r /opt/operator-profiles/security-profiles-operator.apparmor || \
+            echo "failed to execute apparmor_parser, profile won't be loaded onto node"
         command:
         - bash
         - -c
@@ -538,7 +543,7 @@ spec:
         volumeMounts:
         - mountPath: /var/lib
           name: host-varlib-volume
-        - mountPath: /opt/seccomp-profiles
+        - mountPath: /opt/operator-profiles
           name: profile-configmap-volume
           readOnly: true
       nodeSelector:
@@ -565,6 +570,63 @@ spec:
 ---
 apiVersion: v1
 data:
+  security-profiles-operator.apparmor: |
+    #include <tunables/global>
+
+    profile k8s-security-profiles-operator /security-profiles-operator flags=(complain) {
+        #include <abstractions/base>
+
+        deny capability net_raw,
+
+        network inet stream,
+        network inet6 stream,
+
+        deny network inet udp,
+        deny network inet icmp,
+        deny network raw,
+        deny network netlink raw,
+        deny network packet,
+
+        file,
+
+        /security-profiles-operator ix,
+
+        /proc/sys/net/core/somaxconn r,
+        /sys/kernel/mm/transparent_hugepage/hpage_pmd_size r,
+
+        # Read service account token
+        /var/run/secrets/kubernetes.io/serviceaccount/** r,
+
+        # Read and write profiles
+        /var/lib/kubelet/seccomp/** rw,
+        /var/lib/security-profiles-operator/** rw,
+
+        # TODO:
+        # deny sensitive files within kubelet folder
+
+        deny /bin/** wl,
+        deny /boot/** wl,
+        deny /dev/** wl,
+        deny /etc/** wl,
+        deny /home/** wl,
+        deny /lib/** wl,
+        deny /lib64/** wl,
+        deny /media/** wl,
+        deny /mnt/** wl,
+        deny /opt/** wl,
+        deny /proc/** wl,
+        deny /root/** wl,
+        deny /sbin/** wl,
+        deny /srv/** wl,
+        deny /tmp/** wl,
+        deny /sys/** wl,
+        deny /usr/** wl,
+
+        deny /bin/bash mrwklx,
+        deny /bin/sh mrwklx,
+
+        deny mount,
+    }
   security-profiles-operator.json: |
     {
       "defaultAction": "SCMP_ACT_ERRNO",