Skip to content

L
lxc
Commit dc76ac7a by Serge Hallyn
Options

add lxc-default-cgns profile

This isn't safe for privileged containers which do not use cgroup namespaces, but is required for systemd containers with cgroup namespaces. So create a new profile for it which lxc will use as the default when it knows it can. Signed-off-by: 's avatarSerge Hallyn <serge.hallyn@ubuntu.com>
parent 82d97f87
Showing with 15 additions and 0 deletions
config/apparmor/Makefile.am
...@@ -7,6 +7,7 @@ EXTRA_DIST = \ ...@@ -7,6 +7,7 @@ EXTRA_DIST = \
lxc-containers \ lxc-containers \
lxc-generate-aa-rules.py \ lxc-generate-aa-rules.py \
profiles/lxc-default \ profiles/lxc-default \
profiles/lxc-default-cgns \
profiles/lxc-default-with-mounting \ profiles/lxc-default-with-mounting \
profiles/lxc-default-with-nesting \ profiles/lxc-default-with-nesting \
usr.bin.lxc-start usr.bin.lxc-start
...@@ -20,6 +21,7 @@ install-apparmor: ...@@ -20,6 +21,7 @@ install-apparmor:
$(INSTALL_DATA) abstractions/container-base $(DESTDIR)$(sysconfdir)/apparmor.d/abstractions/lxc/ $(INSTALL_DATA) abstractions/container-base $(DESTDIR)$(sysconfdir)/apparmor.d/abstractions/lxc/
$(INSTALL_DATA) abstractions/start-container $(DESTDIR)$(sysconfdir)/apparmor.d/abstractions/lxc/ $(INSTALL_DATA) abstractions/start-container $(DESTDIR)$(sysconfdir)/apparmor.d/abstractions/lxc/
$(INSTALL_DATA) profiles/lxc-default $(DESTDIR)$(sysconfdir)/apparmor.d/lxc/ $(INSTALL_DATA) profiles/lxc-default $(DESTDIR)$(sysconfdir)/apparmor.d/lxc/
$(INSTALL_DATA) profiles/lxc-default-cgns $(DESTDIR)$(sysconfdir)/apparmor.d/lxc/
$(INSTALL_DATA) profiles/lxc-default-with-mounting $(DESTDIR)$(sysconfdir)/apparmor.d/lxc/ $(INSTALL_DATA) profiles/lxc-default-with-mounting $(DESTDIR)$(sysconfdir)/apparmor.d/lxc/
$(INSTALL_DATA) profiles/lxc-default-with-nesting $(DESTDIR)$(sysconfdir)/apparmor.d/lxc/ $(INSTALL_DATA) profiles/lxc-default-with-nesting $(DESTDIR)$(sysconfdir)/apparmor.d/lxc/
$(INSTALL_DATA) lxc-containers $(DESTDIR)$(sysconfdir)/apparmor.d/ $(INSTALL_DATA) lxc-containers $(DESTDIR)$(sysconfdir)/apparmor.d/
...@@ -30,6 +32,7 @@ uninstall-apparmor: ...@@ -30,6 +32,7 @@ uninstall-apparmor:
rm -f $(DESTDIR)$(sysconfdir)/apparmor.d/lxc-containers rm -f $(DESTDIR)$(sysconfdir)/apparmor.d/lxc-containers
rm -f $(DESTDIR)$(sysconfdir)/apparmor.d/lxc/lxc-default-with-nesting rm -f $(DESTDIR)$(sysconfdir)/apparmor.d/lxc/lxc-default-with-nesting
rm -f $(DESTDIR)$(sysconfdir)/apparmor.d/lxc/lxc-default-with-mounting rm -f $(DESTDIR)$(sysconfdir)/apparmor.d/lxc/lxc-default-with-mounting
rm -f $(DESTDIR)$(sysconfdir)/apparmor.d/lxc/lxc-default-cgns
rm -f $(DESTDIR)$(sysconfdir)/apparmor.d/lxc/lxc-default rm -f $(DESTDIR)$(sysconfdir)/apparmor.d/lxc/lxc-default
rm -f $(DESTDIR)$(sysconfdir)/apparmor.d/abstractions/lxc/start-container rm -f $(DESTDIR)$(sysconfdir)/apparmor.d/abstractions/lxc/start-container
rm -f $(DESTDIR)$(sysconfdir)/apparmor.d/abstractions/lxc/container-base rm -f $(DESTDIR)$(sysconfdir)/apparmor.d/abstractions/lxc/container-base
......
config/apparmor/profiles/lxc-default-cgns 0 → 100644
# Do not load this file. Rather, load /etc/apparmor.d/lxc-containers, which
# will source all profiles under /etc/apparmor.d/lxc
profile lxc-container-default-cgns flags=(attach_disconnected,mediate_deleted) {
#include <abstractions/lxc/container-base>
# the container may never be allowed to mount devpts. If it does, it
# will remount the host's devpts. We could allow it to do it with
# the newinstance option (but, right now, we don't).
deny mount fstype=devpts,
mount fstype=cgroup -> /sys/fs/cgroup/**,
}
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment