<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">On Thu, May 29, 2014 at 5:08 AM, Serge Hallyn <span dir="ltr"><<a href="mailto:serge.hallyn@ubuntu.com" target="_blank">serge.hallyn@ubuntu.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div class=""><div class="h5">Quoting Fajar A. Nugraha (<a href="mailto:list@fajar.net">list@fajar.net</a>):<br>
> (changed subject to match content)<br>
><br>
> On Tue, May 27, 2014 at 11:10 PM, Michael H. Warfield <<a href="mailto:mhw@wittsend.com">mhw@wittsend.com</a>> wrote:<br>
> > On Tue, 2014-05-27 at 15:33 +0700, Fajar A. Nugraha wrote:<br>
> >> On further test, this seems enough<br>
> ><br>
> >> ###<br>
> >> # cat lxc-default-with-systemd<br>
> >> profile lxc-container-default-with-systemd<br>
> >> flags=(attach_disconnected,mediate_deleted) {<br>
> >> #include <abstractions/lxc/container-base><br>
> >> deny mount fstype=devpts,<br>
> >> mount options=(none,name=systemd) fstype=cgroup -> /sys/fs/cgroup/systemd/,<br>
> >> }<br>
> >> ###<br>
> ><br>
> > This sounds excellent. It sounds like this should be incorporated into<br>
> > the lxc package for any host distros supporting app armour and we could<br>
> > then add that default to all the systemd based containers such as<br>
> > Fedora, Suse, eventually Oracle, and eventually CentOS.<br>
> ><br>
> > I agree it does seem to make more sense to use a restrictive profile<br>
> > that covers the minimal set of requirements as opposed to unconfined.<br>
> ><br>
> > That should be submitted as a patch over on the lxc-devel list then, for<br>
> > Serge and Stéphane to review. I see where the file would need to be<br>
> > added in the config/apparmour/profiles directory but I'm not familiar<br>
> > enough with the packaging for Ubuntu to know what changes would be<br>
> > needed to add them there.<br>
><br>
> I'll let Serge comment on this one.<br>
><br>
><br>
> As a side note, I've tested opensuse 13.1 (using the squashfs root<br>
> from rescue ISO) and it has two additional complains with the previous<br>
> apparmor profile:<br>
><br>
> May 27 17:12:50 trusty kernel: [66563.219898] type=1400<br>
> audit(1401185570.578:9249): apparmor="DENIED" operation="mount"<br>
> info="failed type match" error=-13<br>
> profile="lxc-container-default-with-systemd" name="/var/run/"<br>
> pid=30648 comm="mount" srcname="/run/" flags="rw, bind"<br>
<br>
</div></div>Hm. In Debian/Ubuntu this is done with a /var/run -> /run<br>
symlink...<br></blockquote><div><br></div><div>something like that could probably be added to the opensuse template, modifying the current mount service.</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div class=""><br>
> May 27 17:21:20 trusty kernel: [67073.932892] type=1400<br>
> audit(1401186080.906:9846): apparmor="DENIED" operation="mount"<br>
> info="failed flags match" error=-13 profile="lxc-container-opensuse"<br>
> name="/proc/" pid=4158 comm="mount" flags="rw, remount"<br>
><br>
> the second one (/proc) is pretty harmless, so I ignored it. The first<br>
> one (/var/run) produced lots of errors<br>
><br>
> [FAILED] Failed to mount Runtime Directory.<br>
> See 'systemctl status var-run.mount' for details.<br>
> [DEPEND] Dependency failed for System Logging Service.<br>
> Mounting Runtime Directory...<br>
><br>
><br>
> ... and made syslog (and possibly other services) failed to start, so<br>
> for opensuse I had to adjust the profile even further<br>
><br>
> ###<br>
> profile lxc-container-opensuse flags=(attach_disconnected,mediate_deleted) {<br>
> #include <abstractions/lxc/container-base><br>
> deny mount fstype=devpts,<br>
> mount options=(none,name=systemd) fstype=cgroup -> /sys/fs/cgroup/systemd/,<br>
> mount options=(rw,bind),<br>
> }<br>
> ###<br>
><br>
> Bind mounts inside a container should be safe, right? While there are<br>
> still some problems with opensuse container (e.g. shutdown takes a<br>
> long time on "systemctl stop network@eth0.service"), it is at least<br>
> usable for testing purposes.<br>
<br>
</div>would systemd be happy with it being mounted by lxc using an<br>
lxc.mount.entry? I think that would be preferable to relaxing the<br>
apparmor policy. i.e.<br>
<br>
lxc.mount.entry = /sys/fs/cgroup/systemd sys/fs/cgroup/systemd none bind,create=dir,optional 0 0<br>
<br></blockquote><div><br></div><div>Wouldn't that be shadowed by the container mounting its own /sys?</div><div>Stephane also pointed out in my (closed) pull request that it would also allow the container to mess with the hosts's resource allocation.</div>
<div><br></div><div>This works (at least, tested with console and ssh login), and should be secure-enough (bind-mount the container subdir, instead of the whole systemd cgroup), but complicated.</div><div><br></div><div>### snippet of config</div>
<div><div>lxc.hook.mount = "/var/lib/lxc/f20/bin/create_container_systemd_cgroup"</div><div>lxc.hook.post-stop = "/var/lib/lxc/f20/bin/remove_container_systemd_cgroup"</div></div><div>###</div><div><br>
</div><div>### cat create_container_systemd_cgroup </div><div>#!/bin/bash</div><div>mkdir -p /sys/fs/cgroup/systemd/lxc/$LXC_NAME</div><div>mount -t sysfs sysfs $LXC_ROOTFS_MOUNT/sys</div><div>mount -t tmpfs none $LXC_ROOTFS_MOUNT/sys/fs/cgroup</div>
<div>mkdir $LXC_ROOTFS_MOUNT/sys/fs/cgroup/systemd</div><div>mount --bind /sys/fs/cgroup/systemd/lxc/$LXC_NAME $LXC_ROOTFS_MOUNT/sys/fs/cgroup/systemd</div><div><div>###</div></div><div><br></div><div><div>### cat remove_container_systemd_cgroup </div>
<div>#!/bin/bash</div><div>[ -n "$LXC_NAME" ] && find /sys/fs/cgroup/systemd/lxc/$LXC_NAME -type d | tac | xargs rmdir</div><div>###<br></div></div><div><br></div><div>Is there a way to simplify this somehow for it to be more suitable in the template?</div>
<div><br></div><div>-- </div><div>Fajar</div></div></div></div>