[lxc-devel] [PATCH 1/1] apparmor: allow writes to sem* and msg* sysctls

[Serge Hallyn]

/proc/sys/kernel/sem* and /proc/sys/kernel/msg* are ipc sysctls
which are properly namespaced.  Allow writes to them from
containers.

Reported-by: Dan Kegel <dank at kegel.com>
Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
---
 config/apparmor/abstractions/container-base | 9 +++++++--
 config/apparmor/container-rules             | 9 +++++++--
 config/apparmor/container-rules.base        | 2 ++
 3 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/config/apparmor/abstractions/container-base b/config/apparmor/abstractions/container-base
index c109baa..71e9348 100644
--- a/config/apparmor/abstractions/container-base
+++ b/config/apparmor/abstractions/container-base
@@ -55,7 +55,7 @@
   deny /proc/sys/ker[^n]*{,/**} wklx,
   deny /proc/sys/kern[^e]*{,/**} wklx,
   deny /proc/sys/kerne[^l]*{,/**} wklx,
-  deny /proc/sys/kernel/[^shd]*{,/**} wklx,
+  deny /proc/sys/kernel/[^smhd]*{,/**} wklx,
   deny /proc/sys/kernel/d[^o]*{,/**} wklx,
   deny /proc/sys/kernel/do[^m]*{,/**} wklx,
   deny /proc/sys/kernel/dom[^a]*{,/**} wklx,
@@ -74,7 +74,12 @@
   deny /proc/sys/kernel/hostna[^m]*{,/**} wklx,
   deny /proc/sys/kernel/hostnam[^e]*{,/**} wklx,
   deny /proc/sys/kernel/hostname?*{,/**} wklx,
-  deny /proc/sys/kernel/s[^h]*{,/**} wklx,
+  deny /proc/sys/kernel/m[^s]*{,/**} wklx,
+  deny /proc/sys/kernel/ms[^g]*{,/**} wklx,
+  deny /proc/sys/kernel/msg*/** wklx,
+  deny /proc/sys/kernel/s[^he]*{,/**} wklx,
+  deny /proc/sys/kernel/se[^m]*{,/**} wklx,
+  deny /proc/sys/kernel/sem*/** wklx,
   deny /proc/sys/kernel/sh[^m]*{,/**} wklx,
   deny /proc/sys/kernel/shm*/** wklx,
   deny /proc/sys/kernel?*{,/**} wklx,
diff --git a/config/apparmor/container-rules b/config/apparmor/container-rules
index 2c8c0b4..ea5c408 100644
--- a/config/apparmor/container-rules
+++ b/config/apparmor/container-rules
@@ -5,7 +5,7 @@
   deny /proc/sys/ker[^n]*{,/**} wklx,
   deny /proc/sys/kern[^e]*{,/**} wklx,
   deny /proc/sys/kerne[^l]*{,/**} wklx,
-  deny /proc/sys/kernel/[^shd]*{,/**} wklx,
+  deny /proc/sys/kernel/[^smhd]*{,/**} wklx,
   deny /proc/sys/kernel/d[^o]*{,/**} wklx,
   deny /proc/sys/kernel/do[^m]*{,/**} wklx,
   deny /proc/sys/kernel/dom[^a]*{,/**} wklx,
@@ -24,7 +24,12 @@
   deny /proc/sys/kernel/hostna[^m]*{,/**} wklx,
   deny /proc/sys/kernel/hostnam[^e]*{,/**} wklx,
   deny /proc/sys/kernel/hostname?*{,/**} wklx,
-  deny /proc/sys/kernel/s[^h]*{,/**} wklx,
+  deny /proc/sys/kernel/m[^s]*{,/**} wklx,
+  deny /proc/sys/kernel/ms[^g]*{,/**} wklx,
+  deny /proc/sys/kernel/msg*/** wklx,
+  deny /proc/sys/kernel/s[^he]*{,/**} wklx,
+  deny /proc/sys/kernel/se[^m]*{,/**} wklx,
+  deny /proc/sys/kernel/sem*/** wklx,
   deny /proc/sys/kernel/sh[^m]*{,/**} wklx,
   deny /proc/sys/kernel/shm*/** wklx,
   deny /proc/sys/kernel?*{,/**} wklx,
diff --git a/config/apparmor/container-rules.base b/config/apparmor/container-rules.base
index 615f015..a657481 100644
--- a/config/apparmor/container-rules.base
+++ b/config/apparmor/container-rules.base
@@ -8,6 +8,8 @@ allow /sys/devices/virtual/net/**
 allow /sys/class/net/**
 block /proc/sys
 allow /proc/sys/kernel/shm*
+allow /proc/sys/kernel/sem*
+allow /proc/sys/kernel/msg*
 allow /proc/sys/kernel/hostname
 allow /proc/sys/kernel/domainname
 allow /proc/sys/net/**
-- 
1.9.1