fix(k3s): Add AppArmor rule for proc/thread-self/attr to allow containerd exec profiling (#63)

* fix(k3s): Add AppArmor rule for proc/thread-self/attr to allow containerd exec profiling

Without /proc/thread-self/attr/** rw, containerd cannot write to
/proc/thread-self/attr/apparmor/exec when applying AppArmor profiles
to container exec processes, causing OCI runtime exec failures.

* fix(k3s): Narrow AppArmor attr path to apparmor subtree for least-privilege

Scope /proc/thread-self/attr/** down to /proc/thread-self/attr/apparmor/**
to avoid exposing SELinux and other LSM attribute files unnecessarily.
Add inline comment explaining why rw access is required on this path.

Author: sbaerlocher

CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.3.7] - 2026-03-21
+
+### Fixed
+
+- Added AppArmor rule `/proc/thread-self/attr/** rw` to k3s security profile; required for containerd to apply AppArmor profiles to container exec processes (`apparmor failed to apply profile: write /proc/thread-self/attr/apparmor/exec: operation not permitted`)
+
 ## [1.3.6] - 2026-03-21
 
 ### Fixed

galaxy.yml

@@ -1,7 +1,7 @@
 ---
 namespace: arillso
 name: container
-version: 1.3.6
+version: 1.3.7
 readme: README.md
 
 authors:

roles/k3s/tasks/security.yml

@@ -173,6 +173,7 @@
                   # Process and system info (broad /proc/** needed for containerd/kubelet)
                   /proc/** r,
                   /proc/thread-self/fd/** rw,
+                  /proc/thread-self/attr/apparmor/** rw,  # containerd reads/writes AppArmor exec profile via this path
                   /proc/sys/fs/pipe-max-size r,
                   /etc/machine-id r,
                   /sys/devices/virtual/dmi/id/product_uuid r,