refactor AppArmor into LSM backend, add SELinux support

[mirror_lxc.git] / src / lxc / conf.h

diff --git a/src/lxc/conf.h b/src/lxc/conf.h
index 5febf126d0f042dffb10772f67e095fdd82291bf..8c2dc4e8fc9ca81cc38a552fe07a333db6bac81d 100644 (file)
--- a/src/lxc/conf.h
+++ b/src/lxc/conf.h
@@ -221,6 +221,16 @@ struct lxc_rootfs {
        char *pivot;
 };
 
+/*
+ * Automatic mounts for LXC to perform inside the container
+ */
+enum {
+       LXC_AUTO_PROC        = 0x01,   /* /proc */
+       LXC_AUTO_SYS         = 0x02,   /* /sys*/
+       LXC_AUTO_CGROUP      = 0x04,   /* /sys/fs/cgroup */
+       LXC_AUTO_PROC_SYSRQ  = 0x08,   /* /proc/sysrq-trigger over-bind-mounted with /dev/null */
+};
+
 /*
  * Defines the global container configuration
  * @rootfs     : root directory to run the container
@@ -237,9 +247,8 @@ struct lxc_rootfs {
  * @tty_info   : tty data
  * @console    : console data
  * @ttydir     : directory (under /dev) in which to create console and ttys
-#if HAVE_APPARMOR
- * @aa_profile : apparmor profile to switch to
-#endif
+ * @lsm_aa_profile : apparmor profile to switch to or NULL
+ * @lsm_se_context : selinux type to switch to or NULL
  */
 enum lxchooks {
        LXCHOOK_PRESTART, LXCHOOK_PREMOUNT, LXCHOOK_MOUNT, LXCHOOK_AUTODEV,
@@ -265,6 +274,7 @@ struct lxc_conf {
        struct lxc_list network;
        struct saved_nic *saved_nics;
        int num_savednics;
+       int auto_mounts;
        struct lxc_list mount_list;
        struct lxc_list caps;
        struct lxc_list keepcaps;
@@ -274,13 +284,10 @@ struct lxc_conf {
        char *ttydir;
        int close_all_fds;
        struct lxc_list hooks[NUM_LXC_HOOKS];
-#if HAVE_APPARMOR
-       char *aa_profile;
-#endif
 
-#if HAVE_APPARMOR /* || HAVE_SELINUX || HAVE_SMACK */
+       char *lsm_aa_profile;
+       char *lsm_se_context;
        int lsm_umount_proc;
-#endif
        char *seccomp;  // filename with the seccomp rules
 #if HAVE_SCMP_FILTER_CTX
        scmp_filter_ctx *seccomp_ctx;
@@ -336,8 +343,9 @@ extern int uid_shift_ttys(int pid, struct lxc_conf *conf);
  * Configure the container from inside
  */
 
+struct cgroup_process_info;
 extern int lxc_setup(const char *name, struct lxc_conf *lxc_conf,
-                       const char *lxcpath);
+                       const char *lxcpath, struct cgroup_process_info *cgroup_info);
 
 extern void lxc_rename_phys_nics_on_shutdown(struct lxc_conf *conf);
 #endif