docker snap does not support custom apparmor profiles per container

[Alfonso Sanchez-Beato]

docker supports loading custom apparmor profiles that can be different for each container [1] by using the option "--security-opt apparmor=<your_profile>".

However, this does not work with the docker snap because the docker snapd interface only allows sending signals to a profile named "docker-default" (the default profile for docker containers), so if the name of the profile is different, you cannot stop the container using the docker cli. You get denials when trying to send the kill signal to the container.

Allowing the docker snap to handle custom apparmor profiles for the containers would allow further confinement of the payloads.

[1] https://docs.docker.com/engine/security/apparmor/

[Jamie Strandboge (jdstrand)]

The docker snap should be updated to plugs 'process-control'. I'd prefer not to change the docker-support interface for this when process-control already handles it.

[Jamie Strandboge (jdstrand)]

Removing the 'docker' task as that package is for a KDE component (the deb should be docker.io) and because this doesn't affect the deb.

[Ian Johnson (anonymouse67)]

Jamie, I thought that the docker snap was not allowed to transition to an apparmor profile other than docker-default by design/policy? Has that policy changed?

[Jamie Strandboge (jdstrand)]

Ian, docker:privileged allows it: 'change_profile unsafe /**,'. This is technically for transitioning to unconfined (since there isn't an 'unconfined' profile, we can't specify it in the policy), but it allows transitioning containers (and itself) to other profiles.