From 056f8bba0d86ca2ba481a932f23faff9db2ef588 Mon Sep 17 00:00:00 2001 From: =?utf8?q?St=C3=A9phane=20Graber?= Date: Mon, 7 Mar 2016 15:01:17 -0500 Subject: [PATCH] Properly update the generated apparmor profiles MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Some changes happened but the final profiles weren't generated... Signed-off-by: Stéphane Graber --- config/apparmor/abstractions/container-base | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/config/apparmor/abstractions/container-base b/config/apparmor/abstractions/container-base index ac8d4e993..6e924dbee 100644 --- a/config/apparmor/abstractions/container-base +++ b/config/apparmor/abstractions/container-base @@ -62,6 +62,10 @@ # allow bind mount of /lib/init/fstab for lxcguest mount options=(rw, bind) /lib/init/fstab.lxc/ -> /lib/init/fstab/, + # allow bind mounts of /run/{,lock} to /var/run/{,lock} + mount options=(rw, bind) /run/ -> /var/run/, + mount options=(rw, bind) /run/lock/ -> /var/lock/, + # deny writes in /proc/sys/fs but allow binfmt_misc to be mounted mount fstype=binfmt_misc -> /proc/sys/fs/binfmt_misc/, deny @{PROC}/sys/fs/** wklx, @@ -83,9 +87,11 @@ deny mount fstype=debugfs -> /var/lib/ureadahead/debugfs/, mount fstype=proc -> /proc/, mount fstype=sysfs -> /sys/, + mount options=(rw, nosuid, nodev, noexec, remount) -> /sys/, deny /sys/firmware/efi/efivars/** rwklx, deny /sys/kernel/security/** rwklx, mount options=(move) /sys/fs/cgroup/cgmanager/ -> /sys/fs/cgroup/cgmanager.lower/, + mount options=(ro, nosuid, nodev, noexec, remount, strictatime) -> /sys/fs/cgroup/, # generated by: lxc-generate-aa-rules.py container-rules.base deny /proc/sys/[^kn]*{,/**} wklx, -- 2.39.2