{{tag>Brouillon Sécurité}} # Notes AppArmor Voir : * https://docs.docker.com/engine/security/apparmor/ The nscd Apparmor profile is not prepared for that and needs some additional capabilities added. `/etc/apparmor.d/openntpd` ~~~ # vim:syntax=apparmor #include /usr/sbin/ntpd flags=(attach_disconnected) { #include #include # conf /etc/openntpd/ntpd.conf r, # capabilities capability kill, capability sys_chroot, capability setgid, capability setuid, capability sys_time, capability sys_nice, /usr/sbin/ntpd mrix, /var/lib/openntpd/db/ntpd.drift rw, /var/lib/openntpd/run/ntpd.sock rw, } ~~~ Necessary changes are: `/etc/nscd.conf` ~~~ server-user nobody ~~~ `/etc/apparmor.d/usr.sbin.nscd` ~~~ capability setgid, capability setuid, ~~~ After adding these lines, restart Apparmor and subsequently nscd source : https://www.suse.com/fr-fr/support/kb/doc/?id=000017971 ## K3S rootless ~~~bash cat <, include /usr/local/bin/k3s flags=(unconfined) { userns, include if exists } EOF sudo systemctl restart apparmor.service ~~~ Source : https://docs.k3s.io/advanced