11

I have a Docker container (LXC) which runs MySQL. Since the idea behind Docker is generally "one running process per container," if I define AppArmor profiles targeting the MySQL binary, will they be enforced? Is there a way for me to test for this?

Improve this question
2
  • why you want to use apparmor inside the container?
    – c4f4t0r
    Commented May 5, 2014 at 18:05
  • 3
    In case a zero-day or other exploit is run against the database to prevent it from accessing anything else. I trust Linux cgroups, but not that much. It's better to be safe than sorry, I'd rather have MySQL locked down than have a MySQL zero-day find a way to break out of a cgroup.
    – Naftuli Kay
    Commented May 5, 2014 at 18:18

2 Answers 2

Reset to default
8
+50

First, cgroups are not used to isolate an application from others on a system. They are used to manage resource usage and device access. It's the various namespaces (PID, UTS, mount, user...) that provide some (limited) isolation.

Moreover, a process launched inside a Docker container will probably not be able to manage the AppArmor profile it is running under. The approach currently taken is to setup a specific AppArmor profile before launching the container.

It looks like the libcontainer execution driver in Docker supports setting AppArmor profiles for containers, but I can't find any example or reference in the doc.

Apparently AppArmor is also supported with LXC in Ubuntu.

You should write an AppArmor profile for your application and make sure LXC/libcontainer/Docker/... loads it before starting the processes inside the container.

Profiles used this way should be enforced, and to test it you should try an illegal access and make sure it fails.

There is no link between the binary and the actually enforced profile in this case. You have to explicitly tell Docker/LXC to use this profile for your container. Writing a profile for the MySQL binary will only enforce it on the host, not in the container.

Improve this answer
3
  • This has been my (limited) experience so far. I've had problems generating a profile from within a Docker container, but if a profile were generated outside of the container and then copied in, it should just work™, provided of course that you start AppArmor in the container before running the executable.
    – Naftuli Kay
    Commented May 12, 2014 at 17:46
  • @Siosm: LCX != libcontainer. The question was about the LXC driver.
    – 0xC0000022L
    Commented Jun 19, 2014 at 15:43
  • @0xC0000022L: The AppArmor profile enforcement model is the same for any tool used to confine processes in containers.
    – Timothée Ravier
    Commented Jun 20, 2014 at 7:19
3

The answer is very likely: no.

The Ubuntu Server guide topic LXC discusses pretty much your exact question and makes the following statement:

Programs in a container cannot be further confined - for instance, MySQL runs under the container profile (protecting the host) but will not be able to enter the MySQL profile (to protect the container).

A better option to avoid exploits having unwanted effects is to confine the user running the container and use userspace LXC containers that leverage the feature of the kernel. However, docker currently - to my knowledge - does not support userns.

In such a case MySQL would - from the hosts perspective - run as unprivileged user, while inside the container it could be run as root. You can then use iptables to bind the MySQL to an external port of the host, if needed.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .