feat: add apparmor pkg

Bring in AppArmor pkg from `pkgs` which would add `/sbin/apparmor_parser` which would get picked by containerd. Signed-off-by: Noel Georgi <git@frezbo.dev>
siderolabs · Jun 27, 2024 · bd34f71 · bd34f71
1 parent 71857fd
commit bd34f71
Show file tree

Hide file tree

Showing 5 changed files with 25 additions and 3 deletions.
diff --git a/Dockerfile b/Dockerfile
@@ -30,6 +30,7 @@ ARG PKG_LIBAIO
 ARG PKG_MUSL
 ARG PKG_RUNC
 ARG PKG_XFSPROGS
+ARG PKG_APPARMOR
 ARG PKG_UTIL_LINUX
 ARG PKG_KMOD
 ARG PKG_KERNEL
@@ -40,6 +41,9 @@ ARG PKG_TALOSCTL_CNI_BUNDLE_INSTALL
 FROM ${PKG_FHS} AS pkg-fhs
 FROM ${PKG_CA_CERTIFICATES} AS pkg-ca-certificates
 
+FROM --platform=amd64 ${PKG_APPARMOR} AS pkg-apparmor-amd64
+FROM --platform=arm64 ${PKG_APPARMOR} AS pkg-apparmor-arm64
+
 FROM --platform=amd64 ${PKG_CRYPTSETUP} AS pkg-cryptsetup-amd64
 FROM --platform=arm64 ${PKG_CRYPTSETUP} AS pkg-cryptsetup-arm64
 
@@ -558,6 +562,7 @@ COPY --from=depmod-arm64 /build/lib/modules /lib/modules
 FROM build AS rootfs-base-amd64
 COPY --link --from=pkg-fhs / /rootfs
 COPY --link --from=pkg-ca-certificates / /rootfs
+COPY --link --from=pkg-apparmor-amd64 / /rootfs
 COPY --link --from=pkg-cryptsetup-amd64 / /rootfs
 COPY --link --from=pkg-containerd-amd64 / /rootfs
 COPY --link --from=pkg-dosfstools-amd64 / /rootfs
@@ -622,6 +627,7 @@ END
 FROM build AS rootfs-base-arm64
 COPY --link --from=pkg-fhs / /rootfs
 COPY --link --from=pkg-ca-certificates / /rootfs
+COPY --link --from=pkg-apparmor-arm64 / /rootfs
 COPY --link --from=pkg-cryptsetup-arm64 / /rootfs
 COPY --link --from=pkg-containerd-arm64 / /rootfs
 COPY --link --from=pkg-dosfstools-arm64 / /rootfs

diff --git a/Makefile b/Makefile
@@ -18,14 +18,15 @@ ARTIFACTS := _out
 TOOLS ?= ghcr.io/siderolabs/tools:v1.8.0-alpha.0-5-gd2746e5
 
 PKGS_PREFIX ?= ghcr.io/siderolabs
-PKGS ?= v1.8.0-alpha.0-23-gc309452
+PKGS ?= v1.8.0-alpha.0-29-g84bad89
 EXTRAS ?= v1.8.0-alpha.0-2-g0efb05f
 
 KRES_IMAGE ?= ghcr.io/siderolabs/kres:latest
 CONFORMANCE_IMAGE ?= ghcr.io/siderolabs/conform:latest
 
 PKG_FHS ?= $(PKGS_PREFIX)/fhs:$(PKGS)
 PKG_CA_CERTIFICATES ?= $(PKGS_PREFIX)/ca-certificates:$(PKGS)
+PKG_APPARMOR ?= $(PKGS_PREFIX)/apparmor:$(PKGS)
 PKG_CRYPTSETUP ?= $(PKGS_PREFIX)/cryptsetup:$(PKGS)
 PKG_CONTAINERD ?= $(PKGS_PREFIX)/containerd:$(PKGS)
 PKG_DOSFSTOOLS ?= $(PKGS_PREFIX)/dosfstools:$(PKGS)
@@ -177,6 +178,7 @@ COMMON_ARGS += --build-arg=REGISTRY=$(REGISTRY)
 COMMON_ARGS += --build-arg=PKGS_PREFIX=$(PKGS_PREFIX)
 COMMON_ARGS += --build-arg=PKG_FHS=$(PKG_FHS)
 COMMON_ARGS += --build-arg=PKG_CA_CERTIFICATES=$(PKG_CA_CERTIFICATES)
+COMMON_ARGS += --build-arg=PKG_APPARMOR=$(PKG_APPARMOR)
 COMMON_ARGS += --build-arg=PKG_CRYPTSETUP=$(PKG_CRYPTSETUP)
 COMMON_ARGS += --build-arg=PKG_CONTAINERD=$(PKG_CONTAINERD)
 COMMON_ARGS += --build-arg=PKG_DOSFSTOOLS=$(PKG_DOSFSTOOLS)

diff --git a/hack/release.toml b/hack/release.toml
@@ -27,6 +27,20 @@ Flannel: 0.25.3
 Talos is built with Go 1.22.4.
 """
 
+    [notes.apparmor]
+        title = "Workload Apparmor Profile"
+        description = """\
+Talos Linux can now apply the default AppArmor profiles to all workloads started via containerd, if the machine is installed with the AppArmor LSM enforced via the extraKernelArgs.
+
+Eg:
+
+```yaml
+machine:
+    install:
+        extraKernelArgs:
+            - security=apparmor
+```
+"""
 
     [notes.zstd]
         title = "ZSTD Compression"

diff --git a/pkg/machinery/constants/constants.go b/pkg/machinery/constants/constants.go
@@ -14,7 +14,7 @@ import (
 
 const (
 	// DefaultKernelVersion is the default Linux kernel version.
-	DefaultKernelVersion = "6.6.32-talos"
+	DefaultKernelVersion = "6.6.33-talos"
 
 	// KernelModulesPath is the default path to the kernel modules without the kernel version.
 	KernelModulesPath = "/lib/modules"

diff --git a/pkg/machinery/gendata/data/pkgs b/pkg/machinery/gendata/data/pkgs
@@ -1 +1 @@
-v1.8.0-alpha.0-23-gc309452
+v1.8.0-alpha.0-29-g84bad89