Skip to content

L
lxc
Commit 603fd084 by Serge Hallyn
Options

Apparmor: use lxc-default-cgns if cgns is enabled

Because containers need to - and safely can - mount cgroufs in that case. Note that if cgns is enabled but the unshare fails, we fail the container start, so checking whether they are enabled is enough. Signed-off-by: 's avatarSerge Hallyn <serge.hallyn@ubuntu.com>
parent dc76ac7a
Showing with 8 additions and 2 deletions
src/lxc/lsm/apparmor.c
...@@ -31,6 +31,7 @@ ...@@ -31,6 +31,7 @@
#include "log.h" #include "log.h"
#include "lsm/lsm.h" #include "lsm/lsm.h"
#include "conf.h" #include "conf.h"
#include "utils.h"
lxc_log_define(lxc_apparmor, lxc); lxc_log_define(lxc_apparmor, lxc);
...@@ -40,6 +41,7 @@ static int aa_enabled = 0; ...@@ -40,6 +41,7 @@ static int aa_enabled = 0;
static int mount_features_enabled = 0; static int mount_features_enabled = 0;
#define AA_DEF_PROFILE "lxc-container-default" #define AA_DEF_PROFILE "lxc-container-default"
#define AA_DEF_PROFILE_CGNS "lxc-container-default-cgns"
#define AA_MOUNT_RESTR "/sys/kernel/security/apparmor/features/mount/mask" #define AA_MOUNT_RESTR "/sys/kernel/security/apparmor/features/mount/mask"
#define AA_ENABLED_FILE "/sys/module/apparmor/parameters/enabled" #define AA_ENABLED_FILE "/sys/module/apparmor/parameters/enabled"
#define AA_UNCHANGED "unchanged" #define AA_UNCHANGED "unchanged"
...@@ -202,8 +204,12 @@ static int apparmor_process_label_set(const char *inlabel, struct lxc_conf *conf ...@@ -202,8 +204,12 @@ static int apparmor_process_label_set(const char *inlabel, struct lxc_conf *conf
free(curlabel); free(curlabel);
if (!label) { if (!label) {
if (use_default) if (use_default) {
label = AA_DEF_PROFILE; if (cgns_supported())
label = AA_DEF_PROFILE_CGNS;
else
label = AA_DEF_PROFILE;
}
else else
label = "unconfined"; label = "unconfined";
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment