[lxc-users] some questions about lxc with apparmor
serge.hallyn at ubuntu.com
Fri Sep 12 14:22:58 UTC 2014
Quoting Weng Meiling (wengmeiling.weng at huawei.com):
> Hi guys,
> I want to use apparmor to do some limits on container, but I can't success.
> my environment:
> template: suse template
> lxc: 1.0.0.beta1 //build with apparmor enable
> # rpm -qa | grep apparmor
> upstream 3.4 kernel and 3.16 kernel
> # cat config | grep APPARMOR
> # cat /sys/module/apparmor/parameters/enabled
What does /sys/kernel/security/apparmor/features/mount/mask show?
That depends on some new apparmor features still making their
The current behavior when these are missing is not right, but hasn't
yet been fixed. We should either fail the container startup, clearly
warning the user that the full apparmor profile wouldn't have been
enabled, or we should warn the user (which will likely get lost) and
go ahead and load the apparmor profile.
Well, or better, we could scan the apparmor profile for features which
would require the mount feature. I'm not quite sure whether that's
More information about the lxc-users