Merge lp:~xfactor973/apparmor-profiles/ceph-apparmor-profiles into lp:apparmor-profiles

[Chris Holcombe]

This patch includes apparmor profiles for the ceph-mon and ceph-osd processes. These were generated by running an extensive amulet test against the ceph-mon and ceph-osd juju charms. I can't say that they've exercised every possible code path but I think this is a good starting armor profile.

[lp:~xfactor973/apparmor-profiles/ceph-apparmor-profiles]

160. By Chris Holcombe on 2016-03-28

Typo in the ceph-osd profile

[Seth Arnold (seth-arnold)]

Looks like a great start, thanks!

It'd be nice if the /proc/*/.. entries would use /proc/${pid}/.. or /proc/${pids}/.. -- while there's currently no difference between the two variables today, we do intend to modify ${pid} to refer to strictly "the current pid" via a kernel variable eventually.

/srv/ceph/ is probably a fair enough starting point to hardcode but if someone stores their OSDs elsewhere, it'd be nice if there was an #include <local/usr.bin.ceph-osd> line near the bottom of the ceph-osd profile, so these sorts of modifications could be made easily. (See /etc/apparmor.d/usr.sbin.rsyslogd or /etc/apparmor.d/usr.sbin.ntpd for examples.)

Thanks

[Chris Holcombe (xfactor973)]

Thanks! That's great feedback.

[lp:~xfactor973/apparmor-profiles/ceph-apparmor-profiles]

161. By Chris Holcombe on 2016-04-14

Use ${pids} instead of * and also allow users to include site specific overrides

[Christian Boltz (cboltz)]

I'm afraid Seth managed to confuse you - it's @{pid} or @{pids}, not ${pid} and ${pids} ;-)

[Seth Arnold (seth-arnold)]

Argh, I'm sorry Chris! Nice catch Christian. Sigh.

[Chris Holcombe (xfactor973)]

No worries! I'll update this patch after the 16.04 release :)

[lp:~xfactor973/apparmor-profiles/ceph-apparmor-profiles]

162. By Chris Holcombe on 2016-04-19

Use @{pid} not ${pid}

[Steve Beattie (sbeattie)]

Hi, thanks for fixing up the pid/pids variables. I've gone ahead and merged this after also copying the profiles to the 16.04 and 16.10 trees -- I poked around very briefly at a 16.04 ceph install and didn't see anything radically different in FS layout that would give cause for concern (we'll obivously take updates if there things that need to be updated).

While reviewing, I did have one question; both profiles have:

  owner /etc/ceph/* rw,

Is it expected that ceph will need to write to arbitrary files under /etc/ceph/? What's the usage here?

Thanks for the contribution!

review: Approve

[Chris Holcombe (xfactor973)]

Yeah no problem!

For the /etc/ceph/* stuff it does write a few things there. The /etc/ceph/ceph.conf and also various cephx key files under different names. I thought /etc/ceph/* would be a safe thing to do because I won't know in advance what all the key names are going to be that it could create. I could probably tighten it up a little bit to something like:

owner /etc/ceph/ceph.conf rw
owner /etc/ceph/ceph.client.* rw
owner /etc/ceph/rbdmap rw

I don't think the charm or ceph writes anything else to that directory. Here's what a current deployment looks like under /etc/ceph/
root@ip-172-31-2-78:/etc/ceph# ls -lh
total 8.0K
-rw------- 1 root root 63 Apr 28 19:03 ceph.client.admin.keyring
lrwxrwxrwx 1 root root 27 Apr 28 19:01 ceph.conf -> /etc/alternatives/ceph.conf
-rw-r--r-- 1 root root 92 Feb 22 21:15 rbdmap

=== added file 'ubuntu/14.04/usr.bin.ceph-mon'
--- ubuntu/14.04/usr.bin.ceph-mon	1970-01-01 00:00:00 +0000
+++ ubuntu/14.04/usr.bin.ceph-mon	2016-04-19 13:54:25 +0000
@@ -0,0 +1,28 @@
+# vim:syntax=apparmor
+# Author: Chris Holcombe <xfactor973 at gmail_com>
+#include <tunables/global>
+
+/usr/bin/ceph-mon {
+  #include <abstractions/base>
+
+  /usr/bin/ceph-mon mr,
+
+  network inet stream,
+  network inet6 stream,
+
+  owner /etc/ceph/* rw,
+  /etc/passwd r,
+
+  /proc/@{pid}/auxv r,
+  /proc/@{pid}/net/dev r,
+
+  /run/ceph/* rw,
+  /tmp/ r,
+  /var/lib/ceph/** rwk,
+  /var/lib/charm/*/ceph.conf r,
+  /var/log/ceph/* rwk,
+  /var/run/ceph/* rwk,
+  /var/tmp/ r,
+  # Site-specific additions and overrides.
+  #include <local/usr.bin.ceph-mon>
+}
 
=== added file 'ubuntu/14.04/usr.bin.ceph-osd'
--- ubuntu/14.04/usr.bin.ceph-osd	1970-01-01 00:00:00 +0000
+++ ubuntu/14.04/usr.bin.ceph-osd	2016-04-19 13:54:25 +0000
@@ -0,0 +1,30 @@
+# vim:syntax=apparmor
+# Author: Chris Holcombe <xfactor973 at gmail_com>
+#include <tunables/global>
+
+/usr/bin/ceph-osd {
+  #include <abstractions/base>
+
+  /usr/bin/ceph-osd mr,
+
+  network inet stream,
+  network inet6 stream,
+
+  owner /etc/ceph/* rw,
+  /etc/passwd r,
+
+  /proc/@{pids}/auxv r,
+  /proc/@{pids}/net/dev r,
+  /proc/loadavg r,
+
+  /run/ceph/* rw,
+  /srv/ceph/** r,
+  /tmp/ r,
+  /var/lib/ceph/** rwk,
+  /var/lib/charm/*/ceph.conf r,
+  /var/log/ceph/* rwk,
+  /var/run/ceph/* rwk,
+  /var/tmp/ r,
+  # Site-specific additions and overrides.
+  #include <local/usr.bin.ceph-osd>
+}