[lxc-devel] [lxd/master] lxd/apparmor: Apparently the order matters

stgraber on Github lxc-bot at linuxcontainers.org
Sun Mar 22 17:24:52 UTC 2020


A non-text attachment was scrubbed...
Name: not available
Type: text/x-mailbox
Size: 354 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20200322/87db3aee/attachment.bin>
-------------- next part --------------
From 02c91e4e39b0fd7a0d5f3df6af898d77bc5e08f3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?St=C3=A9phane=20Graber?= <stgraber at ubuntu.com>
Date: Sun, 22 Mar 2020 13:24:10 -0400
Subject: [PATCH] lxd/apparmor: Apparently the order matters
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
---
 lxd/apparmor/apparmor.go | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/lxd/apparmor/apparmor.go b/lxd/apparmor/apparmor.go
index abeb15bf0f..ceec2dece0 100644
--- a/lxd/apparmor/apparmor.go
+++ b/lxd/apparmor/apparmor.go
@@ -211,6 +211,23 @@ const profileBase = `
   mount options=(ro,remount,bind,noatime) /sy[^s]*{,/**},
   mount options=(ro,remount,bind,noatime) /sys?*{,/**},
 
+  mount options=(ro,remount,noatime,bind) /[^spd]*{,/**},
+  mount options=(ro,remount,noatime,bind) /d[^e]*{,/**},
+  mount options=(ro,remount,noatime,bind) /de[^v]*{,/**},
+  mount options=(ro,remount,noatime,bind) /dev/.[^l]*{,/**},
+  mount options=(ro,remount,noatime,bind) /dev/.l[^x]*{,/**},
+  mount options=(ro,remount,noatime,bind) /dev/.lx[^c]*{,/**},
+  mount options=(ro,remount,noatime,bind) /dev/.lxc?*{,/**},
+  mount options=(ro,remount,noatime,bind) /dev/[^.]*{,/**},
+  mount options=(ro,remount,noatime,bind) /dev?*{,/**},
+  mount options=(ro,remount,noatime,bind) /p[^r]*{,/**},
+  mount options=(ro,remount,noatime,bind) /pr[^o]*{,/**},
+  mount options=(ro,remount,noatime,bind) /pro[^c]*{,/**},
+  mount options=(ro,remount,noatime,bind) /proc?*{,/**},
+  mount options=(ro,remount,noatime,bind) /s[^y]*{,/**},
+  mount options=(ro,remount,noatime,bind) /sy[^s]*{,/**},
+  mount options=(ro,remount,noatime,bind) /sys?*{,/**},
+
   mount options=(ro,remount,bind,nosuid) /[^spd]*{,/**},
   mount options=(ro,remount,bind,nosuid) /d[^e]*{,/**},
   mount options=(ro,remount,bind,nosuid) /de[^v]*{,/**},


More information about the lxc-devel mailing list