apiVersion: v1
kind: ConfigMap
metadata:
  name: apparmor-profiles
  namespace: apparmor
data:
  k8s-fuse: |-
    # For some reason /etc/apparmor.d/tunables/global wasn't loaded automatically
    # # so loading it manually here. TODO: Figure out why.
    @{PROC}=/proc/
    
    profile fuse flags=(attach_disconnected,mediate_deleted) {
      network,
      capability,
      file,
      umount,
    
      # Sam: Added this for gcs fuse might not be needed for your fuse plugin
      signal,
    
      # ignore DENIED message on / remount
      deny mount options=(ro, remount) -> /,
    
      # allow tmpfs mounts everywhere
      mount fstype=tmpfs,
    
      # allow mqueue mounts everywhere
      mount fstype=mqueue,
    
      # allow fuse mounts everywhere
      mount fstype=fuse,
      mount fstype=fuse.*,
    
      # the container may never be allowed to mount devpts.  If it does, it
      # will remount the host's devpts.  We could allow it to do it with
      # the newinstance option (but, right now, we don't).
      deny mount fstype=devpts,
    
      # allow bind mount of /lib/init/fstab for lxcguest
      mount options=(rw, bind) /lib/init/fstab.lxc/ -> /lib/init/fstab/,
    
      # deny writes in /proc/sys/fs but allow fusectl to be mounted
      mount fstype=binfmt_misc -> /proc/sys/fs/binfmt_misc/,
      deny @{PROC}/sys/fs/** wklx,
    
      # block some other dangerous paths
      deny @{PROC}/sysrq-trigger rwklx,
      deny @{PROC}/mem rwklx,
      deny @{PROC}/kmem rwklx,
      deny @{PROC}/sys/kernel/[^s][^h][^m]* wklx,
      deny @{PROC}/sys/kernel/*/** wklx,
    
      # deny writes in /sys except for /sys/fs/cgroup, also allow
      # fusectl, securityfs and debugfs to be mounted there (read-only)
      mount fstype=fusectl -> /sys/fs/fuse/connections/,
      mount fstype=securityfs -> /sys/kernel/security/,
      mount fstype=debugfs -> /sys/kernel/debug/,
      deny mount fstype=debugfs -> /var/lib/ureadahead/debugfs/,
      mount fstype=proc -> /proc/,
      mount fstype=sysfs -> /sys/,
      deny /sys/[^f]*/** wklx,
      deny /sys/f[^s]*/** wklx,
      deny /sys/fs/[^c]*/** wklx,
      deny /sys/fs/c[^g]*/** wklx,
      deny /sys/fs/cg[^r]*/** wklx,
    }
