<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hi All,<br>
<br>
I'm using LXC on debian 8 and would like to use apparmor to limit
container's access. <br>
<br>
The shipped apparmor profiles are activated and enforced, and by
default the container should now be prohibited to start
subcontainers of its own.<br>
<br>
For some reason this is not the case. <br>
I have now set "lxc.aa_profile = lxc-container-default" in
container's conf. <br>
<br>
<b>output of # apparmor_status </b><b>:</b><br>
apparmor module is loaded.<br>
48 profiles are loaded.<br>
13 profiles are in enforce mode.<br>
/usr/bin/lxc-start<br>
/usr/lib/chromium-browser/chromium-browser//browser_java<br>
/usr/lib/chromium-browser/chromium-browser//browser_openjdk<br>
/usr/lib/chromium-browser/chromium-browser//sanitized_helper<br>
/usr/lib/cups/backend/cups-pdf<br>
/usr/lib/libvirt/virt-aa-helper<br>
/usr/sbin/cups-browsed<br>
/usr/sbin/cupsd<br>
/usr/sbin/cupsd//third_party<br>
/usr/sbin/libvirtd<br>
lxc-container-default<br>
lxc-container-default-with-mounting<br>
lxc-container-default-with-nesting<br>
35 profiles are in complain mode.<br>
/sbin/klogd<br>
/sbin/syslog-ng<br>
/sbin/syslogd<br>
/usr/lib/chromium-browser/chromium-browser<br>
/usr/lib/chromium-browser/chromium-browser//chromium_browser_sandbox<br>
/usr/lib/chromium-browser/chromium-browser//lsb_release<br>
/usr/lib/chromium-browser/chromium-browser//xdgsettings<br>
/usr/lib/dovecot/anvil<br>
/usr/lib/dovecot/auth<br>
/usr/lib/dovecot/config<br>
/usr/lib/dovecot/deliver<br>
/usr/lib/dovecot/dict<br>
/usr/lib/dovecot/dovecot-auth<br>
/usr/lib/dovecot/dovecot-lda<br>
/usr/lib/dovecot/imap<br>
/usr/lib/dovecot/imap-login<br>
/usr/lib/dovecot/lmtp<br>
/usr/lib/dovecot/log<br>
/usr/lib/dovecot/managesieve<br>
/usr/lib/dovecot/managesieve-login<br>
/usr/lib/dovecot/pop3<br>
/usr/lib/dovecot/pop3-login<br>
/usr/lib/dovecot/ssl-params<br>
/usr/sbin/avahi-daemon<br>
/usr/sbin/dnsmasq<br>
/usr/sbin/dovecot<br>
/usr/sbin/identd<br>
/usr/sbin/mdnsd<br>
/usr/sbin/nmbd<br>
/usr/sbin/nscd<br>
/usr/sbin/smbd<br>
/usr/sbin/smbldap-useradd<br>
/usr/sbin/smbldap-useradd///etc/init.d/nscd<br>
/usr/{sbin/traceroute,bin/traceroute.db}<br>
/{usr/,}bin/ping<br>
70 processes have profiles defined.<br>
68 processes are in enforce mode.<br>
/usr/bin/lxc-start (2543) <br>
/usr/bin/lxc-start (2591) <br>
<br>
...etc<br>
<br>
/usr/bin/lxc-start (19742) <br>
/usr/sbin/cups-browsed (1337) <br>
/usr/sbin/cupsd (1483) <br>
/usr/sbin/libvirtd (1339) <br>
2 processes are in complain mode.<br>
/usr/sbin/avahi-daemon (996) <br>
/usr/sbin/avahi-daemon (1076) <br>
0 processes are unconfined but have a profile defined.<br>
<br>
<br>
Best wishes,<br>
Urs<br>
<br>
</body>
</html>