Affected by GO-2022-0354 and 10 other vulnerabilities

GO-2022-0354: Code Injection in CRI-O in github.com/cri-o/cri-o

GO-2022-0363: Sysctls applied to containers with host IPC or host network namespaces can affect the host in github.com/cri-o/cri-o

GO-2022-0426: Incorrect Default Permissions in CRI-O in github.com/cri-o/cri-o

GO-2022-0480: Node DOS by way of memory exhaustion through ExecSync request in CRI-O in github.com/cri-o/cri-o

GO-2022-0608: Incorrect Permission Assignment for Critical Resource in CRI-O in github.com/cri-o/cri-o

GO-2022-1014: CRI-O incorrect handling of supplementary groups may lead to sensitive information disclosure in github.com/cri-o/cri-o

GO-2022-1206: CRI-O vulnerable to /etc/passwd tampering resulting in Privilege Escalation in github.com/cri-o/cri-o

GO-2024-2458: CRI-O's pods can break out of resource confinement on cgroupv2 in github.com/cri-o/cri-o

GO-2024-2791: CRI-O vulnerable to an arbitrary systemd property injection in github.com/cri-o/cri-o

GO-2024-3292: CRI-O: Maliciously structured checkpoint file can gain arbitrary node access in github.com/cri-o/cri-o

GO-2025-3426: CRI-O Path Traversal vulnerability in github.com/cri-o/cri-o

apparmor

package

v1.20.3 Latest Latest Go to latest Published: Jun 2, 2021 License: Apache-2.0 Imports: 5 Imported by: 0

Details

View Source

const DefaultProfile = "crio-default"

DefaultProfile is the default profile name

This section is empty.

This section is empty.

type Config struct {
	// contains filtered or unexported fields
}

Config is the global AppArmor configuration type

func New() *Config

New creates a new default AppArmor configuration instance

func (c *Config) Apply(profile string) (string, error)

Apply returns the trimmed AppArmor profile to be used and reloads if the default profile is specified

func (c *Config) IsEnabled() bool

IsEnabled returns true if AppArmor is enabled via the `apparmor` buildtag and globally by the system.

func (c *Config) LoadProfile(profile string) error

LoadProfile can be used to load a AppArmor profile from the provided path. This method will not fail if AppArmor is disabled.