{"action":"created","issue":{"url":"https://api.github.com/repos/docker/docker/issues/14855","labels_url":"https://api.github.com/repos/docker/docker/issues/14855/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker/issues/14855/comments","events_url":"https://api.github.com/repos/docker/docker/issues/14855/events","html_url":"https://github.com/docker/docker/pull/14855","id":96594920,"number":14855,"title":"Introduce a dedicated unconfined AA policy","user":{"login":"ewindisch","id":73207,"avatar_url":"https://avatars.githubusercontent.com/u/73207?v=3","gravatar_id":"","url":"https://api.github.com/users/ewindisch","html_url":"https://github.com/ewindisch","followers_url":"https://api.github.com/users/ewindisch/followers","following_url":"https://api.github.com/users/ewindisch/following{/other_user}","gists_url":"https://api.github.com/users/ewindisch/gists{/gist_id}","starred_url":"https://api.github.com/users/ewindisch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ewindisch/subscriptions","organizations_url":"https://api.github.com/users/ewindisch/orgs","repos_url":"https://api.github.com/users/ewindisch/repos","events_url":"https://api.github.com/users/ewindisch/events{/privacy}","received_events_url":"https://api.github.com/users/ewindisch/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/docker/docker/labels/status/0-triage","name":"status/0-triage","color":"EEEEEE"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-07-22T15:29:02Z","updated_at":"2015-07-22T20:43:54Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/docker/docker/pulls/14855","html_url":"https://github.com/docker/docker/pull/14855","diff_url":"https://github.com/docker/docker/pull/14855.diff","patch_url":"https://github.com/docker/docker/pull/14855.patch"},"body":"By using the 'unconfined' policy for privileged\r\ncontainers, we have inherited the host's apparmor\r\npolicies, which really make no sense in the\r\ncontext of the container's filesystem.\r\n\r\nFor instance, policies written against\r\nthe paths of binaries such as '/usr/sbin/tcpdump'\r\ncan be easily circumvented by moving the binary\r\nwithin the container filesystem.\r\n\r\nFixes #5490 #14550\r\n\r\nSigned-off-by: Eric Windisch <eric@windisch.us>"},"comment":{"url":"https://api.github.com/repos/docker/docker/issues/comments/123856126","html_url":"https://github.com/docker/docker/pull/14855#issuecomment-123856126","issue_url":"https://api.github.com/repos/docker/docker/issues/14855","id":123856126,"user":{"login":"ewindisch","id":73207,"avatar_url":"https://avatars.githubusercontent.com/u/73207?v=3","gravatar_id":"","url":"https://api.github.com/users/ewindisch","html_url":"https://github.com/ewindisch","followers_url":"https://api.github.com/users/ewindisch/followers","following_url":"https://api.github.com/users/ewindisch/following{/other_user}","gists_url":"https://api.github.com/users/ewindisch/gists{/gist_id}","starred_url":"https://api.github.com/users/ewindisch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ewindisch/subscriptions","organizations_url":"https://api.github.com/users/ewindisch/orgs","repos_url":"https://api.github.com/users/ewindisch/repos","events_url":"https://api.github.com/users/ewindisch/events{/privacy}","received_events_url":"https://api.github.com/users/ewindisch/received_events","type":"User","site_admin":false},"created_at":"2015-07-22T20:43:54Z","updated_at":"2015-07-22T20:43:54Z","body":"@tianon **This** PR will \"stop profiles like mysqld from bleeding into containers and applying to processes that they shouldn't\".\r\n\r\nSee #14864 for a policy for the docker binary, hardening against attacks against the engine itself (whether via vulnerabilities in image pulls / extraction, or some other vectors)"}}