Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have a Docker container (LXC) which runs MySQL. Since the idea behind Docker is generally "one running process per container," if I define AppArmor profiles targeting the MySQL binary, will they be enforced? Is there a way for me to test for this?

share|improve this question
    
why you want to use apparmor inside the container? –  c4f4t0r May 5 at 18:05
1  
In case a zero-day or other exploit is run against the database to prevent it from accessing anything else. I trust Linux cgroups, but not that much. It's better to be safe than sorry, I'd rather have MySQL locked down than have a MySQL zero-day find a way to break out of a cgroup. –  Naftuli Tzvi Kay May 5 at 18:18

2 Answers 2

up vote 1 down vote accepted
+50

First, cgroups are not used to isolate an application from others on a system. They are used to manage resource usage and device access. It's the various namespaces (PID, UTS, mount, user...) that provide some (limited) isolation.

Moreover, a process launched inside a Docker container will probably not be able to manage the AppArmor profile it is running under. The approach currently taken is to setup a specific AppArmor profile before launching the container.

It looks like the libcontainer execution driver in Docker supports setting AppArmor profiles for containers, but I can't find any example or reference in the doc.

Apparently AppArmor is also supported with LXC in Ubuntu.

You should write an AppArmor profile for your application and make sure LXC/libcontainer/Docker/... loads it before starting the processes inside the container.

Profiles used this way should be enforced, and to test it you should try an illegal access and make sure it fails.

There is no link between the binary and the actually enforced profile in this case. You have to explicitly tell Docker/LXC to use this profile for your container. Writing a profile for the MySQL binary will only enforce it on the host, not in the container.

share|improve this answer
    
This has been my (limited) experience so far. I've had problems generating a profile from within a Docker container, but if a profile were generated outside of the container and then copied in, it should just work™, provided of course that you start AppArmor in the container before running the executable. –  Naftuli Tzvi Kay May 12 at 17:46
    
@Siosm: LCX != libcontainer. The question was about the LXC driver. –  0xC0000022L Jun 19 at 15:43
    
@0xC0000022L: The AppArmor profile enforcement model is the same for any tool used to confine processes in containers. –  Siosm Jun 20 at 7:19

The answer is very likely: no.

The Ubuntu Server guide topic LXC discusses pretty much your exact question and makes the following statement:

Programs in a container cannot be further confined - for instance, MySQL runs under the container profile (protecting the host) but will not be able to enter the MySQL profile (to protect the container).

A better option to avoid exploits having unwanted effects is to confine the user running the container and use userspace LXC containers that leverage the feature of the kernel. However, docker currently - to my knowledge - does not support userns.

In such a case MySQL would - from the hosts perspective - run as unprivileged user, while inside the container it could be run as root. You can then use iptables to bind the MySQL to an external port of the host, if needed.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.