[lxc-devel] [lxc/lxc] d68092: Allow containers to start in AppArmor namespaces
GitHub
noreply at github.com
Fri Jul 7 21:43:22 UTC 2017
Branch: refs/heads/master
Home: https://github.com/lxc/lxc
Commit: d680929bbc07e399ceaf8954c2059bd788905fc7
https://github.com/lxc/lxc/commit/d680929bbc07e399ceaf8954c2059bd788905fc7
Author: Frédéric Dalleau <frederic.dalleau at collabora.com>
Date: 2017-07-07 (Fri, 07 Jul 2017)
Changed paths:
M config/apparmor/abstractions/start-container
Log Message:
-----------
Allow containers to start in AppArmor namespaces
This patch allows users to start containers in AppArmor namespaces.
Users can define their own profiles for their containers, but
lxc-start must be allowed to change to a namespace.
A container configuration file can wrap a container in an AppArmor
profile using lxc.aa_profile.
A process in an AppArmor namespace is restricted to view
or manage only the profiles belonging to this namespace, as if no
other profiles existed. A namespace can be created as follow:
sudo mkdir /sys/kernel/security/apparmor/policy/namespaces/$NAMESPACE
AppArmor can stack profiles so that the contained process is bound
by the intersection of all profiles of the stack. This is achieved
using the '//&' operator as follow:
lxc.aa_profile = $PROFILE//&:$NAMESPACE://unconfined
In this case, even the guest process appears unconfined in the
namespace, it is still confined by $PROFILE.
A guest allowed to access "/sys/kernel/security/apparmor/** rwklix,"
will be able to manage its own profile set, while still being
enclosed in the topmost profile $PROFILE:
Different guests can be assigned the same namespace or different
namespaces. In the first case, they will share their profiles.
In the second case, they will have distinct sets of profiles.
This is validated on privileged containers.
Signed-off-by: Frédéric Dalleau <frederic.dalleau at collabora.com>
Commit: 996b20c4e25980fb870be47f923b9922d9782977
https://github.com/lxc/lxc/commit/996b20c4e25980fb870be47f923b9922d9782977
Author: Stéphane Graber <stgraber at stgraber.org>
Date: 2017-07-07 (Fri, 07 Jul 2017)
Changed paths:
M config/apparmor/abstractions/start-container
Log Message:
-----------
Merge pull request #1682 from brauner/2017-07-07/enable_apparmor_namespaces
Allow containers to start in AppArmor namespaces
Compare: https://github.com/lxc/lxc/compare/6262244de93d...996b20c4e259
More information about the lxc-devel
mailing list