drop useless apparmor denies

mem and kmem are really in /dev, so this does us no good. Signed-off-by: Tycho Andersen <tycho@tycho.ws>

drop useless apparmor denies
737340a2 · Tycho Andersen · Stéphane Graber · 3400d77a · 737340a2 · 737340a2
Unverified Commit 737340a2 authored Oct 02, 2017 by Tycho Andersen Committed by Stéphane Graber Oct 04, 2017
Hide whitespace changes
Inline Side-by-side

Showing with 1 addition and 5 deletions

container-base config/apparmor/abstractions/container-base +0 -2

container-base.in config/apparmor/abstractions/container-base.in +0 -2

aa.c src/tests/aa.c +1 -1

No files found.
--- a/config/apparmor/abstractions/container-base
+++ b/config/apparmor/abstractions/container-base
@@ -72,8 +72,6 @@
  # block some other dangerous paths
  deny @{PROC}/kcore rwklx,
-  deny @{PROC}/kmem rwklx,
-  deny @{PROC}/mem rwklx,
  deny @{PROC}/sysrq-trigger rwklx,
  # deny writes in /sys except for /sys/fs/cgroup, also allow

--- a/config/apparmor/abstractions/container-base.in
+++ b/config/apparmor/abstractions/container-base.in
@@ -72,8 +72,6 @@
  # block some other dangerous paths
  deny @{PROC}/kcore rwklx,
-  deny @{PROC}/kmem rwklx,
-  deny @{PROC}/mem rwklx,
  deny @{PROC}/sysrq-trigger rwklx,
  # deny writes in /sys except for /sys/fs/cgroup, also allow

--- a/src/tests/aa.c
+++ b/src/tests/aa.c
@@ -105,7 +105,7 @@ char *files_to_allow[] = { "/sys/class/net/lo/ifalias",
 		"/proc/sys/kernel/shmmax",
 		NULL };
-char *files_to_deny[] = { "/proc/mem", "/proc/kmem",
+char *files_to_deny[] = {
 		"/sys/kernel/uevent_helper",
 		"/proc/sys/fs/file-nr",
 		"/sys/kernel/mm/ksm/pages_to_scan",