Merge pull request #897 from hallyn/2016-03-16/aa

config/apparmor/abstractions/container-base

@@ -66,6 +66,9 @@
   mount options=(rw, bind) /run/ -> /var/run/,
   mount options=(rw, bind) /run/lock/ -> /var/lock/,
 
+  # deny access under /proc/bus to avoid e.g. messing with pci devices directly
+  deny @{PROC}/bus/** wklx,
+
   # deny writes in /proc/sys/fs but allow binfmt_misc to be mounted
   mount fstype=binfmt_misc -> /proc/sys/fs/binfmt_misc/,
   deny @{PROC}/sys/fs/** wklx,

config/apparmor/abstractions/container-base.in

@@ -66,6 +66,9 @@
   mount options=(rw, bind) /run/ -> /var/run/,
   mount options=(rw, bind) /run/lock/ -> /var/lock/,
 
+  # deny access under /proc/bus to avoid e.g. messing with pci devices directly
+  deny @{PROC}/bus/** wklx,
+
   # deny writes in /proc/sys/fs but allow binfmt_misc to be mounted
   mount fstype=binfmt_misc -> /proc/sys/fs/binfmt_misc/,
   deny @{PROC}/sys/fs/** wklx,

config/templates/common.conf.in

@@ -10,7 +10,7 @@ lxc.pts = 1024
 lxc.tty = 4
 
 # Drop some harmful capabilities
-lxc.cap.drop = mac_admin mac_override sys_time sys_module
+lxc.cap.drop = mac_admin mac_override sys_time sys_module sys_rawio
 
 # Set the pivot directory
 lxc.pivotdir = lxc_putold