proxmox-mirrors/mirror_lxc
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_lxc synced 2025-08-14 09:47:06 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #1055 from stgraber/master

Browse Source 
apparmor: Allow bind-mounts and {r}shared/{r}private
This commit is contained in:
Christian Brauner 2016-06-23 23:28:19 +02:00 committed by GitHub
commit 18f9cbeea7
2 changed files with 62 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
config/apparmor/abstractions/container-base
View File

@ -60,13 +60,6 @@
mount fstype=fuse,
mount fstype=fuse.*,
# allow bind mount of /lib/init/fstab for lxcguest
mount options=(rw, bind) /lib/init/fstab.lxc/ -> /lib/init/fstab/,
# allow bind mounts of /run/{,lock} to /var/run/{,lock}
mount options=(rw, bind) /run/ -> /var/run/,
mount options=(rw, bind) /run/lock/ -> /var/lock/,
# deny access under /proc/bus to avoid e.g. messing with pci devices directly
deny @{PROC}/bus/** wklx,
@ -100,6 +93,37 @@
# deny reads from debugfs
deny /sys/kernel/debug/{,**} rwklx,
# allow paths to be made shared, rshared, private or rprivate
mount options=(rw,shared) -> /,
mount options=(rw,shared) -> /**,
mount options=(rw,rshared) -> /,
mount options=(rw,rshared) -> /**,
mount options=(rw,private) -> /,
mount options=(rw,private) -> /**,
mount options=(rw,rprivate) -> /,
mount options=(rw,rprivate) -> /**,
# allow bind-mounts of anything except /proc, /sys and /dev
mount options=(rw,bind) /[^spd]*{,/**},
mount options=(rw,bind) /d[^e]*{,/**},
mount options=(rw,bind) /de[^v]*{,/**},
mount options=(rw,bind) /dev/.[^l]*{,/**},
mount options=(rw,bind) /dev/.l[^x]*{,/**},
mount options=(rw,bind) /dev/.lx[^c]*{,/**},
mount options=(rw,bind) /dev/.lxc?*{,/**},
mount options=(rw,bind) /dev/[^.]*{,/**},
mount options=(rw,bind) /dev?*{,/**},
mount options=(rw,bind) /p[^r]*{,/**},
mount options=(rw,bind) /pr[^o]*{,/**},
mount options=(rw,bind) /pro[^c]*{,/**},
mount options=(rw,bind) /proc?*{,/**},
mount options=(rw,bind) /s[^y]*{,/**},
mount options=(rw,bind) /sy[^s]*{,/**},
mount options=(rw,bind) /sys?*{,/**},
# generated by: lxc-generate-aa-rules.py container-rules.base
deny /proc/sys/[^kn]*{,/**} wklx,
deny /proc/sys/k[^e]*{,/**} wklx,

38
config/apparmor/abstractions/container-base.in
View File

@ -60,13 +60,6 @@
mount fstype=fuse,
mount fstype=fuse.*,
# allow bind mount of /lib/init/fstab for lxcguest
mount options=(rw, bind) /lib/init/fstab.lxc/ -> /lib/init/fstab/,
# allow bind mounts of /run/{,lock} to /var/run/{,lock}
mount options=(rw, bind) /run/ -> /var/run/,
mount options=(rw, bind) /run/lock/ -> /var/lock/,
# deny access under /proc/bus to avoid e.g. messing with pci devices directly
deny @{PROC}/bus/** wklx,
@ -100,3 +93,34 @@
# deny reads from debugfs
deny /sys/kernel/debug/{,**} rwklx,
# allow paths to be made shared, rshared, private or rprivate
mount options=(rw,shared) -> /,
mount options=(rw,shared) -> /**,
mount options=(rw,rshared) -> /,
mount options=(rw,rshared) -> /**,
mount options=(rw,private) -> /,
mount options=(rw,private) -> /**,
mount options=(rw,rprivate) -> /,
mount options=(rw,rprivate) -> /**,
# allow bind-mounts of anything except /proc, /sys and /dev
mount options=(rw,bind) /[^spd]*{,/**},
mount options=(rw,bind) /d[^e]*{,/**},
mount options=(rw,bind) /de[^v]*{,/**},
mount options=(rw,bind) /dev/.[^l]*{,/**},
mount options=(rw,bind) /dev/.l[^x]*{,/**},
mount options=(rw,bind) /dev/.lx[^c]*{,/**},
mount options=(rw,bind) /dev/.lxc?*{,/**},
mount options=(rw,bind) /dev/[^.]*{,/**},
mount options=(rw,bind) /dev?*{,/**},
mount options=(rw,bind) /p[^r]*{,/**},
mount options=(rw,bind) /pr[^o]*{,/**},
mount options=(rw,bind) /pro[^c]*{,/**},
mount options=(rw,bind) /proc?*{,/**},
mount options=(rw,bind) /s[^y]*{,/**},
mount options=(rw,bind) /sy[^s]*{,/**},
mount options=(rw,bind) /sys?*{,/**},