Skip to content

L
lxc
Commit 549a40b6 by Stéphane Graber
Options

apparmor: Update mount states handling

Properly list all of the states and the right apparmor stanza for them, then comment them all as actually enabling this would currently let the user bypass apparmor entirely. Signed-off-by: 's avatarStéphane Graber <stgraber@ubuntu.com>
parent 7e4c9a30
Showing with 19 additions and 24 deletions
config/apparmor/abstractions/container-base
......@@ -93,18 +93,15 @@
# deny reads from debugfs
deny /sys/kernel/debug/{,**} rwklx,
# allow paths to be made shared, rshared, private or rprivate
mount options=(rw,shared) -> /,
mount options=(rw,shared) -> /**,
mount options=(rw,rshared) -> /,
mount options=(rw,rshared) -> /**,
mount options=(rw,private) -> /,
mount options=(rw,private) -> /**,
mount options=(rw,rprivate) -> /,
mount options=(rw,rprivate) -> /**,
# allow paths to be made slave, shared, private or unbindable
mount options=(rw,make-slave) -> **,
mount options=(rw,make-rslave) -> **,
mount options=(rw,make-shared) -> **,
mount options=(rw,make-rshared) -> **,
mount options=(rw,make-private) -> **,
mount options=(rw,make-rprivate) -> **,
mount options=(rw,make-unbindable) -> **,
mount options=(rw,make-runbindable) -> **,
# allow bind-mounts of anything except /proc, /sys and /dev
mount options=(rw,bind) /[^spd]*{,/**},
......
config/apparmor/abstractions/container-base.in
......@@ -93,18 +93,16 @@
# deny reads from debugfs
deny /sys/kernel/debug/{,**} rwklx,
# allow paths to be made shared, rshared, private or rprivate
mount options=(rw,shared) -> /,
mount options=(rw,shared) -> /**,
mount options=(rw,rshared) -> /,
mount options=(rw,rshared) -> /**,
mount options=(rw,private) -> /,
mount options=(rw,private) -> /**,
mount options=(rw,rprivate) -> /,
mount options=(rw,rprivate) -> /**,
# allow paths to be made slave, shared, private or unbindable
# FIXME: This currently doesn't work due to the apparmor parser treating those as allowing all mounts.
# mount options=(rw,make-slave) -> **,
# mount options=(rw,make-rslave) -> **,
# mount options=(rw,make-shared) -> **,
# mount options=(rw,make-rshared) -> **,
# mount options=(rw,make-private) -> **,
# mount options=(rw,make-rprivate) -> **,
# mount options=(rw,make-unbindable) -> **,
# mount options=(rw,make-runbindable) -> **,
# allow bind-mounts of anything except /proc, /sys and /dev
mount options=(rw,bind) /[^spd]*{,/**},
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment