Skip to content

L
lxc
Commit 1a255d79 by Serge Hallyn Committed by Stéphane Graber
Options

apparmor: allow writes to sem* and msg* sysctls

/proc/sys/kernel/sem* and /proc/sys/kernel/msg* are ipc sysctls which are properly namespaced. Allow writes to them from containers. Reported-by: 's avatarDan Kegel <dank@kegel.com> Signed-off-by: 's avatarSerge Hallyn <serge.hallyn@ubuntu.com> Acked-by: 's avatarStéphane Graber <stgraber@ubuntu.com>
parent 28b939d6
Showing with 16 additions and 4 deletions
config/apparmor/abstractions/container-base
...@@ -55,7 +55,7 @@ ...@@ -55,7 +55,7 @@
deny /proc/sys/ker[^n]*{,/**} wklx, deny /proc/sys/ker[^n]*{,/**} wklx,
deny /proc/sys/kern[^e]*{,/**} wklx, deny /proc/sys/kern[^e]*{,/**} wklx,
deny /proc/sys/kerne[^l]*{,/**} wklx, deny /proc/sys/kerne[^l]*{,/**} wklx,
deny /proc/sys/kernel/[^shd]*{,/**} wklx, deny /proc/sys/kernel/[^smhd]*{,/**} wklx,
deny /proc/sys/kernel/d[^o]*{,/**} wklx, deny /proc/sys/kernel/d[^o]*{,/**} wklx,
deny /proc/sys/kernel/do[^m]*{,/**} wklx, deny /proc/sys/kernel/do[^m]*{,/**} wklx,
deny /proc/sys/kernel/dom[^a]*{,/**} wklx, deny /proc/sys/kernel/dom[^a]*{,/**} wklx,
...@@ -74,7 +74,12 @@ ...@@ -74,7 +74,12 @@
deny /proc/sys/kernel/hostna[^m]*{,/**} wklx, deny /proc/sys/kernel/hostna[^m]*{,/**} wklx,
deny /proc/sys/kernel/hostnam[^e]*{,/**} wklx, deny /proc/sys/kernel/hostnam[^e]*{,/**} wklx,
deny /proc/sys/kernel/hostname?*{,/**} wklx, deny /proc/sys/kernel/hostname?*{,/**} wklx,
deny /proc/sys/kernel/s[^h]*{,/**} wklx, deny /proc/sys/kernel/m[^s]*{,/**} wklx,
deny /proc/sys/kernel/ms[^g]*{,/**} wklx,
deny /proc/sys/kernel/msg*/** wklx,
deny /proc/sys/kernel/s[^he]*{,/**} wklx,
deny /proc/sys/kernel/se[^m]*{,/**} wklx,
deny /proc/sys/kernel/sem*/** wklx,
deny /proc/sys/kernel/sh[^m]*{,/**} wklx, deny /proc/sys/kernel/sh[^m]*{,/**} wklx,
deny /proc/sys/kernel/shm*/** wklx, deny /proc/sys/kernel/shm*/** wklx,
deny /proc/sys/kernel?*{,/**} wklx, deny /proc/sys/kernel?*{,/**} wklx,
......
config/apparmor/container-rules
...@@ -5,7 +5,7 @@ ...@@ -5,7 +5,7 @@
deny /proc/sys/ker[^n]*{,/**} wklx, deny /proc/sys/ker[^n]*{,/**} wklx,
deny /proc/sys/kern[^e]*{,/**} wklx, deny /proc/sys/kern[^e]*{,/**} wklx,
deny /proc/sys/kerne[^l]*{,/**} wklx, deny /proc/sys/kerne[^l]*{,/**} wklx,
deny /proc/sys/kernel/[^shd]*{,/**} wklx, deny /proc/sys/kernel/[^smhd]*{,/**} wklx,
deny /proc/sys/kernel/d[^o]*{,/**} wklx, deny /proc/sys/kernel/d[^o]*{,/**} wklx,
deny /proc/sys/kernel/do[^m]*{,/**} wklx, deny /proc/sys/kernel/do[^m]*{,/**} wklx,
deny /proc/sys/kernel/dom[^a]*{,/**} wklx, deny /proc/sys/kernel/dom[^a]*{,/**} wklx,
...@@ -24,7 +24,12 @@ ...@@ -24,7 +24,12 @@
deny /proc/sys/kernel/hostna[^m]*{,/**} wklx, deny /proc/sys/kernel/hostna[^m]*{,/**} wklx,
deny /proc/sys/kernel/hostnam[^e]*{,/**} wklx, deny /proc/sys/kernel/hostnam[^e]*{,/**} wklx,
deny /proc/sys/kernel/hostname?*{,/**} wklx, deny /proc/sys/kernel/hostname?*{,/**} wklx,
deny /proc/sys/kernel/s[^h]*{,/**} wklx, deny /proc/sys/kernel/m[^s]*{,/**} wklx,
deny /proc/sys/kernel/ms[^g]*{,/**} wklx,
deny /proc/sys/kernel/msg*/** wklx,
deny /proc/sys/kernel/s[^he]*{,/**} wklx,
deny /proc/sys/kernel/se[^m]*{,/**} wklx,
deny /proc/sys/kernel/sem*/** wklx,
deny /proc/sys/kernel/sh[^m]*{,/**} wklx, deny /proc/sys/kernel/sh[^m]*{,/**} wklx,
deny /proc/sys/kernel/shm*/** wklx, deny /proc/sys/kernel/shm*/** wklx,
deny /proc/sys/kernel?*{,/**} wklx, deny /proc/sys/kernel?*{,/**} wklx,
......
config/apparmor/container-rules.base
...@@ -8,6 +8,8 @@ allow /sys/devices/virtual/net/** ...@@ -8,6 +8,8 @@ allow /sys/devices/virtual/net/**
allow /sys/class/net/** allow /sys/class/net/**
block /proc/sys block /proc/sys
allow /proc/sys/kernel/shm* allow /proc/sys/kernel/shm*
allow /proc/sys/kernel/sem*
allow /proc/sys/kernel/msg*
allow /proc/sys/kernel/hostname allow /proc/sys/kernel/hostname
allow /proc/sys/kernel/domainname allow /proc/sys/kernel/domainname
allow /proc/sys/net/** allow /proc/sys/net/**
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment