1

I'm looking to profile a service running inside a specific docker container. I went through the documentation of aa-genprof and aa-autodep and both take program as input to profile. I can't seem to find a way to point those programs to profile a binary inside the docker container.

I tried mounting the directory of the program inside the container and then referencing that program, but its logs are not captured in audit.log. Thoughts?

Is there some other way I can build a profile for that docker container?

1
  • Could you please elaborate on the shortcoming you are facing with aa-genprof - it distinctly takes a program path. Additionally you may set a profile to use complain mode.
    – signus
    Commented Mar 10 at 18:44

1 Answer 1

0

You can use like bane to create the custom profile for the apparmor

1
  • 1
    To use bane we need to know the accesses the program needs. In my scenario, I don't have a comprehensive list of all accesses and syscalls the program needs. Commented Nov 1, 2021 at 15:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .