Add initial apparmor profiles

deploy/apparmor/README.md

@@ -0,0 +1,31 @@
+# Apparmor profiles
+
+In order to get the Virtlet DaemonSet work in
+an [apparmor](https://gitlab.com/apparmor/apparmor/wikis/home) enabled environment follow the next steps:
+
+* install the profiles located in this directory into the corresponding directory (/etc/apparmor.d/ if you use Debian or its derivatives)
+```bash
+sudo install -m 0644 libvirt virtlet vms -t /etc/apparmor.d/
+```
+* apply them by
+  * restarting the apparmor service
+    ```bash
+    sudo systemctl restart apparmor
+    ```
+  * or by hand, using the following commands
+    ```bash
+    sudo apparmor_parser -r /etc/apparmor.d/libvirtd
+    sudo apparmor_parser -r /etc/apparmor.d/virtlet
+    sudo apparmor_parser -r /etc/apparmor.d/vms
+    ```
+* set the corresponding profiles in the Virtlet DaemonSet:
+```yaml
+  spec:
+    template:
+      metadata:
+        annotations:
+          container.apparmor.security.beta.kubernetes.io/libvirt: localhost/libvirtd
+          container.apparmor.security.beta.kubernetes.io/vms: localhost/vms
+          container.apparmor.security.beta.kubernetes.io/virtlet: localhost/virtlet
+```
+* [re]create the Virtlet DamonSet using standard Kubernetes approach

deploy/apparmor/libvirtd

@@ -0,0 +1,72 @@
+# Profile is based on the upstream libvirt profile
+#include <tunables/global>
+
+profile libvirtd flags=(attach_disconnected) {
+  #include <abstractions/base>
+  #include <abstractions/dbus>
+
+  capability kill,
+  capability net_admin,
+  capability net_raw,
+  capability setgid,
+  capability sys_admin,
+  capability sys_module,
+  capability sys_ptrace,
+  capability sys_nice,
+  capability sys_chroot,
+  capability setuid,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability chown,
+  capability setpcap,
+  capability mknod,
+  capability fsetid,
+  capability ipc_lock,
+  capability audit_write,
+
+  # Needed for vfio
+  capability sys_resource,
+
+  network inet stream,
+  network inet dgram,
+  network inet6 stream,
+  network inet6 dgram,
+  network packet dgram,
+  network netlink,
+
+  dbus bus=system,
+  signal,
+  ptrace,
+  unix,
+
+  allow mount,
+  allow umount,
+
+  # for now, use a very lenient profile since we want to first focus on
+  # confining the guests
+  / r,
+  /** rwmkl,
+
+  /bin/* PUx,
+  /sbin/* PUx,
+  /usr/bin/* PUx,
+  /usr/sbin/* PUx,
+  /lib/udev/scsi_id PUx,
+  /usr/lib/xen-common/bin/xen-toolstack PUx,
+  /usr/lib/xen-*/bin/pygrub PUx,
+  /usr/lib/xen-*/bin/libxl-save-helper PUx,
+
+  # Required by nwfilter_ebiptables_driver.c:ebiptablesWriteToTempFile() to
+  # write and run an ebtables script.
+  /var/lib/libvirt/virtd* ixr,
+
+  /etc/libvirt/hooks/** rmix,
+  /etc/xen/scripts/** rmix,
+  /usr/lib/libvirt/* PUxr,
+  /usr/local/sbin/libvirtd rix,
+
+	/sys/kernel/security/apparmor/profiles r,
+
+  /vmwrapper rix,
+}

deploy/apparmor/virtlet

@@ -0,0 +1,64 @@
+#include <tunables/global>
+
+profile virtlet flags=(attach_disconnected) {
+  #include <abstractions/base>
+  #include <abstractions/libvirt-qemu>
+  #include <abstractions/nameservice>
+
+  allow mount,
+  allow umount,
+  allow ptrace (read,trace) peer="unconfined",
+  capability net_admin,
+  capability net_raw,
+  capability sys_admin,
+  capability sys_chroot,
+  network inet raw,
+  network inet6 raw,
+
+  / r,
+  /etc/ethertypes r,
+  /etc/cni/net.d/ r,
+  /etc/cni/net.d/* r,
+  /etc/kubernetes/kubelet.kubeconfig r,
+  /etc/kubernetes/ssl/* r,
+  /{usr/,}bin/genisoimage rix,
+  /{usr/,}bin/socat rix,
+  /{usr/,}bin/ip rix,
+  /{usr/,}bin/nsenter rix,
+  /{usr/,}bin/qemu-img rix,
+  /{usr/,}sbin/ebtables rix,
+  /{usr/,}sbin/brctl rix,
+  /opt/cni/bin/calico* rix,
+  /usr{/local,}/bin/virtlet mrix,
+  /usr{/local,}/lib/lib{virt,guest}*.so* rm,
+  /var/lib/etcd/*.pem r,
+  /var/lib/libvirt/virtd* ixr,
+  /var/lib/libvirt/*.sock rw,
+  /var/lib/virtlet/** rwk,
+  /var/lib/kubelet/pods/** rw,
+  /var/log/pods/** rw,
+  /{var/,}tmp/{,**} rw,
+
+  @{PROC}/@{pid}/net/psched r,
+  @{PROC}/@{pid}/net/ipv6_route r,
+  @{PROC}/@{pid}/status r,
+  @{PROC}/@{pid}/environ r,
+  @{PROC}/sys/kernel/hostname r,
+  @{PROC}/sys/net/core/somaxconn r,
+  @{PROC}/sys/net/ipv4/conf/cali*/* w,
+  @{PROC}/sys/net/ipv4/neigh/cali*/* w,
+
+  /run/libvirt/libvirt-sock rw,
+  /run/virtlet.sock rw,
+  /run/netns/ r,
+  /run/netns/* rw,
+
+  /sys/class/net/ r,
+  /sys/devices/pci*/*/*/ r,
+  /sys/devices/pci*/*/*/* r,
+  /sys/devices/virtual/net/br*/bridge/ageing_time rw,
+  /sys/bus/pci/devices/ r,
+  /sys/bus/pci/devices/*/driver/unbind w,
+
+  /start.sh r,
+}

deploy/apparmor/vms

@@ -0,0 +1,19 @@
+#include <tunables/global>
+
+profile vms {
+  #include <abstractions/libvirt-qemu>
+
+  ptrace trace peer=@{profile_name},
+  ptrace readby,
+  ptrace tracedby,
+
+  /{usr/,}bin/sleep rix,
+  /{usr/,}bin/cut rix,
+  /{var/,}tmp/{,**} r,
+
+  /var/lib/virtlet/vms.procfile w,
+  /vms.sh rix,
+
+  @{PROC}/@{pid}/stat r,
+
+}

deploy/real-cluster.md

@@ -4,7 +4,7 @@ For Virtlet to work, the following prerequisites have to be fulfilled
 on the nodes which will run them:
 
 1. Node names must be resolvable via DNS configured on the nodes
-1. AppArmor and SELinux must be disabled on the nodes
+1. SELinux must be disabled on the nodes (apparmor is currently supported)
 1. Kubernetes 1.8 and 1.9 must have the MountPropagation=true feature gate enabled in API server and on all kubelet instances
 
 Virtlet deployment consists of preparing the nodes and then deploying
@@ -21,6 +21,11 @@ Repeat it on each node that's going to run Virtlet.
 
 # Deploying Virtlet DaemonSet
 
+## Applying apparmor profiles
+Follow [this guide](apparmor/README.md) if you deploy
+the Virtlet DaemonSet on an apparmor-enabled environment.
+##
+
 First, you need to apply `extraRuntime=virtlet` label to each node that will run Virtlet DaemonSet (replace `XXXXXX` with the node name):
 ```bash
 kubectl label node XXXXXX extraRuntime=virtlet