drop useless apparmor denies

mem and kmem are really in /dev, so this does us no good.

Signed-off-by: Tycho Andersen <tycho@tycho.ws>

diff --git a/config/apparmor/abstractions/container-base b/config/apparmor/abstractions/container-base
index 06290de2c16694deda7f0dea22ef307fd83c5895..a5e6c35f6077b63067a27ebf31bc71a4880b93c0 100644 (file)
--- a/config/apparmor/abstractions/container-base
+++ b/config/apparmor/abstractions/container-base
@@ -72,8 +72,6 @@
 
   # block some other dangerous paths
   deny @{PROC}/kcore rwklx,
-  deny @{PROC}/kmem rwklx,
-  deny @{PROC}/mem rwklx,
   deny @{PROC}/sysrq-trigger rwklx,
 
   # deny writes in /sys except for /sys/fs/cgroup, also allow

diff --git a/config/apparmor/abstractions/container-base.in b/config/apparmor/abstractions/container-base.in
index 5bc9b28bf22d71212ec170b6072e8101e944a2e3..16529bbf0df7b6383460c61479b9dd1c04fdfd1a 100644 (file)
--- a/config/apparmor/abstractions/container-base.in
+++ b/config/apparmor/abstractions/container-base.in
@@ -72,8 +72,6 @@
 
   # block some other dangerous paths
   deny @{PROC}/kcore rwklx,
-  deny @{PROC}/kmem rwklx,
-  deny @{PROC}/mem rwklx,
   deny @{PROC}/sysrq-trigger rwklx,
 
   # deny writes in /sys except for /sys/fs/cgroup, also allow

diff --git a/src/tests/aa.c b/src/tests/aa.c
index c96b4666ad62903e2e5c57ae852cbbd37206c99e..025ac8c9d8eda1c5921f88cd8175683e9f5fb0ee 100644 (file)
--- a/src/tests/aa.c
+++ b/src/tests/aa.c
@@ -105,7 +105,7 @@ char *files_to_allow[] = { "/sys/class/net/lo/ifalias",
                "/proc/sys/kernel/shmmax",
                NULL };
 
-char *files_to_deny[] = { "/proc/mem", "/proc/kmem",
+char *files_to_deny[] = {
                "/sys/kernel/uevent_helper",
                "/proc/sys/fs/file-nr",
                "/sys/kernel/mm/ksm/pages_to_scan",