Différences

Ci-dessous, les différences entre deux révisions de la page.

--- tech:notes_apparmor [2026/02/06 10:14] – Jean-Baptiste
+++ tech:notes_apparmor [2026/06/08 14:09] (Version actuelle) – Jean-Baptiste
@@ Ligne 1: / Ligne 1: @@
+<!DOCTYPE markdown>
+{{tag>Brouillon Sécurité}}
+# Notes AppArmor
+Voir :
+* https://docs.docker.com/engine/security/apparmor/
+The nscd Apparmor profile is not prepared for that and needs some additional
+capabilities added.
+`/etc/apparmor.d/openntpd`
+~~~
+# vim:syntax=apparmor
+#include <tunables/global>
+/usr/sbin/ntpd flags=(attach_disconnected) {
+  #include <abstractions/base>
+  #include <abstractions/nameservice>
+  # conf
+  /etc/openntpd/ntpd.conf r,
+  # capabilities
+  capability kill,
+  capability sys_chroot,
+  capability setgid,
+  capability setuid,
+  capability sys_time,
+  capability sys_nice,
+  /usr/sbin/ntpd mrix,
+  /var/lib/openntpd/db/ntpd.drift rw,
+  /var/lib/openntpd/run/ntpd.sock rw,
+}
+~~~
+Necessary changes are:
+`/etc/nscd.conf`
+~~~
+        server-user             nobody
+~~~
+`/etc/apparmor.d/usr.sbin.nscd`
+~~~
+          capability setgid,
+          capability setuid,
+~~~
+After adding these lines, restart Apparmor and subsequently nscd
+source : https://www.suse.com/fr-fr/support/kb/doc/?id=000017971
+## K3S rootless
+~~~bash
+cat <<EOF | sudo tee "/etc/apparmor.d/usr.local.bin.k3s"
+abi <abi/4.0>,
+include <tunables/global>
+/usr/local/bin/k3s flags=(unconfined) {
+  userns,
+  include if exists <local/usr.local.bin.k3s>
+}
+EOF
+sudo systemctl restart apparmor.service
+~~~
+Source : https://docs.k3s.io/advanced