[lxc-users] some questions about lxc with apparmor

[Tom Weber]

You might be hitting what I described in
https://lists.linuxcontainers.org/pipermail/lxc-users/2014-August/007467.html

after removing that apparmor-mount-dependency (see thread above), i can
work quite nicely with lxc.

  Tom 


Am Freitag, den 12.09.2014, 18:20 +0800 schrieb Weng Meiling:
> Hi guys,
> 
> I want to use apparmor to do some limits on container, but I can't success.
> 
> my environment:
> 
> template: suse template
> 
> lxc: 1.0.0.beta1  //build with apparmor enable
> 
> apparmor:
> # rpm -qa | grep apparmor
> apparmor-dbus-2.3-3.22
> libapparmor1-2.5.1.r1445-55.57.47
> yast2-apparmor-2.17.12-0.5.73
> perl-apparmor-2.5.1.r1445-55.57.47
> apparmor-utils-2.5.1.r1445-55.57.47
> apparmor-profile-editor-0.9.1-268.35
> libapparmor1-32bit-2.5.1.r1445-55.57.47
> apparmor-profiles-2.5.1.r1445-52.55.1
> apparmor-admin_en-10.3-8.24.1
> apparmor-docs-2.5.1.r1445-55.57.47
> apparmor-parser-2.5.1.r1445-55.57.47
> apparmorapplet-gnome-0.9-81.16.57
> libapparmor-devel-2.5.1.r1445-55.57.47
> 
> kernel:
> upstream 3.4 kernel and 3.16 kernel
> 
> # cat config | grep APPARMOR
> CONFIG_SECURITY_APPARMOR=y
> CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE=1
> CONFIG_SECURITY_APPARMOR_COMPAT_24=y
> CONFIG_DEFAULT_SECURITY_APPARMOR=y
> 
> # cat /sys/module/apparmor/parameters/enabled
> Y
> 
> but when I specify the apparmor profile with lxc.aa_profile, the container starts, but the profile is
> not effective, with debug message I found the lsm drv always is nop. I found the comment "The nop driver
> is used when LXC has compiled in support for AppArmor or SELinux but neither is enabled in the run time
> environment."  Do not /sys/module/apparmor/parameters/enabled show apparmor enabled in the run time environment?
> 
> and it's strange the lsm drv initialization in lsm_init() always return in the first check:
> 
> __attribute__((constructor))
> void lsm_init(void)
> {
> 	if (drv) {
> 		INFO("LSM security driver %s", drv->name);
> 		return;
> 	}
> 
> 	#if HAVE_APPARMOR
> 	drv = lsm_apparmor_drv_init();
> 	#endif
> 	#if HAVE_SELINUX
> 	if (!drv)
> 		drv = lsm_selinux_drv_init();
> 	#endif
> 
> 	if (!drv)
> 		drv = lsm_nop_drv_init();
> 	INFO("Initialized LSM security driver %s", drv->name);
> }
> 
> but I didn't see any other places to initialize the drv. Who do the initialization?
> 
> Then I change kernel to linux-apparmor v3.4-aa2.8 which with ubuntu apparmor patches,
> although the lxc.aa_profile effect, the container started failed:
> 
> # lxc-start -n wml -f config -o wml -l DEBUG
> lxc-start: No such file or directory - failed to change exec apparmor profile to lxc-default
> lxc-start: invalid sequence number 1. expected 4
> lxc-start: failed to spawn 'wml'
> 
> Then I found the latest lxc code remove the aa_change_onexec(), so I change the code, but it's
> still error:
> 
> # lxc-start -n wml -f config -o wml -l DEBUG
> lxc-start: No such file or directory - failed to change apparmor profile to lxc-default
> lxc-start: invalid sequence number 1. expected 4
> lxc-start: failed to spawn 'wml'
> 
> Did I do anything wrong?  Do I must use ubuntu if I want use lxc with apparmor?
> Any suggestion is appreciative. Thanks!
> 
> 
> 
> 
> 
> _______________________________________________
> lxc-users mailing list
> lxc-users at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-users