[lxc-devel] [lxc/master] apparmor: Allow boot_id

[stgraber on Github]

A non-text attachment was scrubbed...
Name: not available
Type: text/x-mailbox
Size: 354 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20200421/6ffda9b4/attachment.bin>
-------------- next part --------------
From 863845075d3f77d27c91bd9f47d2f8ddc4867bd5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?St=C3=A9phane=20Graber?= <stgraber at ubuntu.com>
Date: Tue, 21 Apr 2020 13:09:07 -0400
Subject: [PATCH] apparmor: Allow boot_id
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
---
 config/apparmor/abstractions/start-container.in | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/config/apparmor/abstractions/start-container.in b/config/apparmor/abstractions/start-container.in
index f2b48235de..9998f1121e 100644
--- a/config/apparmor/abstractions/start-container.in
+++ b/config/apparmor/abstractions/start-container.in
@@ -21,6 +21,8 @@
   # allow pre-mount hooks to stage mounts under /var/lib/lxc/<container>/
   mount -> /var/lib/lxc/{**,},
 
+  mount /dev/.lxc-boot-id -> /proc/sys/kernel/random/boot_id,
+
   # required for some pre-mount hooks
   mount fstype=overlayfs,
   mount fstype=aufs,