apparmor: allow start-container to change to lxc-**

For generated profiles with apparmor namespaces we get profile names with slashes in them. To match those, we need to allow changing to lxc-**, not just lxc-*. Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

apparmor: allow start-container to change to lxc-**
28f9a704 · Wolfgang Bumiller · Christian Brauner · 296f7311 · 28f9a704
Unverified Commit 28f9a704 authored Jul 24, 2018 by Wolfgang Bumiller Committed by Christian Brauner Jul 31, 2018
Hide whitespace changes
Inline Side-by-side

Showing with 1 addition and 0 deletions

start-container config/apparmor/abstractions/start-container +1 -0

No files found.
--- a/config/apparmor/abstractions/start-container
+++ b/config/apparmor/abstractions/start-container
@@ -40,5 +40,6 @@
  pivot_root /usr/lib*/*/lxc/**,

  change_profile -> lxc-*,
+  change_profile -> lxc-**,
  change_profile -> unconfined,
  change_profile -> :lxc-*:unconfined,