From 919a04ed23662e3ca041f5392a1ff3ca78468aee Mon Sep 17 00:00:00 2001 From: Serge Hallyn Date: Wed, 6 Jan 2016 11:45:38 -0800 Subject: [PATCH] apparmor: recognize 'unconfined' as unconfined. Signed-off-by: Serge Hallyn --- src/lxc/lsm/apparmor.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/lxc/lsm/apparmor.c b/src/lxc/lsm/apparmor.c index 43a093e3d..9d8122405 100644 --- a/src/lxc/lsm/apparmor.c +++ b/src/lxc/lsm/apparmor.c @@ -150,8 +150,10 @@ static bool aa_stacking_supported(void) { static bool in_aa_confined_container(void) { char *p = apparmor_process_label_get(getpid()); bool ret = false; - if (p && strcmp(p, "/usr/bin/lxc-start") != 0) + if (p && strcmp(p, "/usr/bin/lxc-start") != 0 && strcmp(p, "unconfined") != 0) { + INFO("Already apparmor-confined under %s", p); ret = true; + } free(p); return ret; } @@ -191,7 +193,6 @@ static int apparmor_process_label_set(const char *inlabel, struct lxc_conf *conf ERROR("already apparmor confined, but new label requested."); return -1; } - INFO("Already apparmor-confined"); return 0; }