Add a nesting.conf which can be included to support nesting containers (v2)

Newer kernels have added a new restriction:  if /proc or /sys on the
host has files or non-empty directories which are over-mounted, and
there is no /proc which fully visible, then it assumes there is a
"security" reason for this.  It prevents anyone in a non-initial user
namespace from creating a new proc or sysfs mount.

To work around this, this patch adds a new 'nesting.conf' which can be
lxc.include'd from a container configuration file.  It adds a
non-overmounted mount of /proc and /sys under /dev/.lxc, so that the
kernel can see that we're not trying to *hide* things like /proc/uptime.
and /sys/devices/virtual/net.  If the host adds this to the config file
for container w1, then container w1 will support unprivileged child
containers.

The nesting.conf file also sets the apparmor profile to the with-nesting
variant, since that is required anyway.  This actually means that
supporting nesting isn't really more work than it used to be, just
different.  Instead of adding

lxc.aa_profile = lxc-container-default-with-nesting

you now just need to

lxc.include = /usr/share/lxc/config/nesting.conf

(Look, fewer characters :)

Finally, in order to maintain the current apparmor protections on
proc and sys, we make /dev/.lxc/{proc,sys} non-read/writeable.
We don't need to be able to use them, we're just showing the
kernel what's what.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>

diff --git a/config/apparmor/profiles/lxc-default-with-nesting b/config/apparmor/profiles/lxc-default-with-nesting
index 91ad6de115ed19a336d5cd768c342c0a9eb202ce..66aa5fd7d5d3db8d0b8fccbeb7e9d6e1d05d8a79 100644 (file)
--- a/config/apparmor/profiles/lxc-default-with-nesting
+++ b/config/apparmor/profiles/lxc-default-with-nesting
@@ -8,6 +8,8 @@ profile lxc-container-default-with-nesting flags=(attach_disconnected,mediate_de
 #  Uncomment the line below if you are not using cgmanager
 #  mount fstype=cgroup -> /sys/fs/cgroup/**,
 
+  deny /dev/.lxc/proc/** rw,
+  deny /dev/.lxc/sys/** rw,
   mount fstype=proc -> /var/cache/lxc/**,
   mount fstype=sysfs -> /var/cache/lxc/**,
   mount options=(rw,bind),

diff --git a/config/templates/Makefile.am b/config/templates/Makefile.am
index 329f919b276e1ffa844b012a838f98e82c0972ad..e587899edf46038203eda54ab8af611577c58402 100644 (file)
--- a/config/templates/Makefile.am
+++ b/config/templates/Makefile.am
@@ -18,6 +18,7 @@ templatesconfig_DATA = \
        gentoo.common.conf \
        gentoo.moresecure.conf \
        gentoo.userns.conf \
+       nesting.conf \
        opensuse.common.conf \
        opensuse.userns.conf \
        oracle.common.conf \

diff --git a/config/templates/nesting.conf.in b/config/templates/nesting.conf.in
new file mode 100644 (file)
index 0000000..b712ef6
--- /dev/null
+++ b/config/templates/nesting.conf.in
@@ -0,0 +1,8 @@
+# Use a profile which allows nesting
+lxc.aa_profile = lxc-container-default-with-nesting
+
+# Add uncovered mounts of proc and sys, else unprivileged users
+# cannot remount those
+
+lxc.mount.entry = proc dev/.lxc/proc proc create=dir,optional 0 0
+lxc.mount.entry = sys dev/.lxc/sys sysfs create=dir,optional 0 0

diff --git a/configure.ac b/configure.ac
index 5e9538e4706be321007f2da821406ce79652e455..4bad326e3a2a075f397850aed9f9c20794c157c2 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -647,6 +647,7 @@ AC_CONFIG_FILES([
        config/templates/gentoo.common.conf
        config/templates/gentoo.moresecure.conf
        config/templates/gentoo.userns.conf
+       config/templates/nesting.conf
        config/templates/opensuse.common.conf
        config/templates/opensuse.userns.conf
        config/templates/oracle.common.conf