From a612fc8bd5203348b311b42e5d606b92b2f81f77 Mon Sep 17 00:00:00 2001 From: Mohataseem Khan Date: Fri, 26 Jun 2026 10:14:07 +0000 Subject: [PATCH] apparmor: allow change_profile for nested container runtimes Signed-off-by: Mohataseem Khan --- pkg/apparmor/apparmor_linux_template.go | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/pkg/apparmor/apparmor_linux_template.go b/pkg/apparmor/apparmor_linux_template.go index 8f2baa72e..239fd7409 100644 --- a/pkg/apparmor/apparmor_linux_template.go +++ b/pkg/apparmor/apparmor_linux_template.go @@ -25,6 +25,14 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) { signal (receive) peer={/usr/bin/,/usr/sbin/,}runc, signal (receive) peer={/usr/bin/,/usr/sbin/,}crun*, signal (receive) peer={/usr/bin/,/usr/sbin/,}podman, + # Allow OCI runtimes running inside this container to assign AppArmor + # profiles to child containers (needed when podman socket is used from + # a systemd/Quadlet-launched container on kernel >= 6.17). + change_profile -> **, + # Allow OCI runtimes running inside this container to assign AppArmor + # profiles to child containers (needed when podman socket is used from + # a systemd/Quadlet-launched container on kernel >= 6.17). + change_profile -> **, {{end}} deny @{PROC}/* w, # deny write for all files directly in /proc (not in a subdir)