proxmox-mirrors/mirror_lxc
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_lxc synced 2025-08-03 08:52:48 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

drop useless apparmor denies

Browse Source 
mem and kmem are really in /dev, so this does us no good.

Signed-off-by: Tycho Andersen <tycho@tycho.ws>
This commit is contained in:
Tycho Andersen 2017-10-02 23:00:21 -06:00
parent a00b86ac4a
commit 408dd86c76
3 changed files with 1 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
config/apparmor/abstractions/container-base
View File

@ -72,8 +72,6 @@
# block some other dangerous paths
deny @{PROC}/kcore rwklx,
deny @{PROC}/kmem rwklx,
deny @{PROC}/mem rwklx,
deny @{PROC}/sysrq-trigger rwklx,
# deny writes in /sys except for /sys/fs/cgroup, also allow

2
config/apparmor/abstractions/container-base.in
View File

@ -72,8 +72,6 @@
# block some other dangerous paths
deny @{PROC}/kcore rwklx,
deny @{PROC}/kmem rwklx,
deny @{PROC}/mem rwklx,
deny @{PROC}/sysrq-trigger rwklx,
# deny writes in /sys except for /sys/fs/cgroup, also allow

2
src/tests/aa.c
View File

@ -105,7 +105,7 @@ char *files_to_allow[] = { "/sys/class/net/lo/ifalias",
"/proc/sys/kernel/shmmax",
NULL };
char *files_to_deny[] = { "/proc/mem", "/proc/kmem",
char *files_to_deny[] = {
"/sys/kernel/uevent_helper",
"/proc/sys/fs/file-nr",
"/sys/kernel/mm/ksm/pages_to_scan",