attach: handle apparmor transitions in !NEWNS cases

If we're not attaching to the mount ns , then don't enter the container's apparmor policy. Since we're running binaries from the host and not the container, that actually seems the sane thing to do (besides also the lazier thing). If we dont' do this patch, then we will need to move the apparmor attach past the procfs remount, will need to also mount securityfs if available, and for the !remount_proc_sys case we'll want to mount those just long enough to do the apparmor transition. Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

attach: handle apparmor transitions in !NEWNS cases
990d9d7c · Serge Hallyn · Stéphane Graber · 53a54099 · 990d9d7c
Commit 990d9d7c authored Mar 06, 2013 by Serge Hallyn Committed by Stéphane Graber Mar 06, 2013
Hide whitespace changes
Inline Side-by-side

Showing with 5 additions and 3 deletions

lxc_attach.c src/lxc/lxc_attach.c +5 -3

No files found.
--- a/src/lxc/lxc_attach.c
+++ b/src/lxc/lxc_attach.c
@@ -376,9 +376,11 @@ int main(int argc, char *argv[])
 		lxc_sync_fini_parent(handler);
 		close(cgroup_ipc_sockets[1]);

-		if (attach_apparmor(init_ctx->aa_profile) < 0) {
-			ERROR("failed switching apparmor profiles");
-			return -1;
+		if ((namespace_flags & CLONE_NEWNS)) {
+			if (attach_apparmor(init_ctx->aa_profile) < 0) {
+				ERROR("failed switching apparmor profiles");
+				return -1;
+			}
 		}

 		/* A description of the purpose of this functionality is