Disable AppArmor for Docker for ptrace_scope

Question

Is it possible to disable AppArmor for a particular Docker container? I want to make ptrace accessible so I can attach gdb to a running process but run into the following issue when I want to change the setting:

root@fbf728150308:/gopath# echo 0 > /proc/sys/kernel/yama/ptrace_scope
bash: /proc/sys/kernel/yama/ptrace_scope: Read-only file system

Phytohormone

Answer 1

AppArmor can be disabled either by running unconfined, or as a privileged container:

• --security-opt apparmor=unconfined (or apparmor:unconfined for docker 1.10 and below)
• --privileged

However, a better option is to create a new profile that enables ptrace. You can use the docker AppArmor profile as a starting point (found in /etc/apparmor.d/docker), and append the ptrace peer=@{profile_name}.

You will also need to disable seccomp (unless using privileged), through --security-opt seccomp=unconfined

Airline

See also docker run --cap-add SYS_PTRACE. docs.docker.com/engine/reference/run/… – Anthropopathy

/etc/apparmor.d/docker does not seem to exist anymore in Docker > v1.13 – Lola

@Peter, I installed the snap version and that would be under the /snap/... but it's not there either. It would be good to have a copy of that file (or a link to it). – Budgie

I found it, it's under a separate folder (i.e. not /etc/...) /var/lib/snapd/apparmor/profiles/snap.docker.docker. That makes sense since we want to be able to edit these files and all /snap/... are read-only. – Budgie