Skip to content

L
lxc
Commit 4fb04047 by Stéphane Graber
Options

apparmor: Use more generic allow rule for pivot

Recent fixes in the apparmor kernel code is now making at least the CI environment and quite possibly some others fail due to an invalid path in the pivot_root stanza. So update both lines to allow a more generic pivot_root call for anything in LXC's work directory. Signed-off-by: 's avatarStéphane Graber <stgraber@ubuntu.com> Acked-by: 's avatarSerge E. Hallyn <serge.hallyn@ubuntu.com>
parent 59630560
Showing with 6 additions and 1 deletion
config/apparmor/abstractions/start-container
...@@ -28,8 +28,13 @@ ...@@ -28,8 +28,13 @@
umount, umount,
#umount /mnt/{**,}, #umount /mnt/{**,},
# This may look a bit redundant, however it appears we need all of
# them if we want things to work properly on all combinations of kernel
# and userspace parser...
pivot_root /usr/lib/lxc/,
pivot_root /usr/lib/*/lxc/, pivot_root /usr/lib/*/lxc/,
pivot_root /usr/lib/lxc/root/, pivot_root /usr/lib/lxc/**,
pivot_root /usr/lib/*/lxc/**,
change_profile -> lxc-*, change_profile -> lxc-*,
change_profile -> unconfined, change_profile -> unconfined,
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment