proxmox-mirrors/mirror_lxc
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_lxc synced 2025-07-14 09:18:23 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

document the new lxc.aa_allow_incomplete flag

Browse Source 
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
This commit is contained in:
Serge Hallyn 2014-09-22 14:18:07 +00:00 committed by Stéphane Graber
parent dc18b2c96e
commit 93c709b231
1 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
doc/lxc.container.conf.sgml.in
View File

@ -1041,6 +1041,27 @@ proc proc proc nodev,noexec,nosuid 0 0
<programlisting>lxc.aa_profile = unconfined</programlisting> <programlisting>lxc.aa_profile = unconfined</programlisting>
</listitem> </listitem>
</varlistentry> </varlistentry>
<varlistentry>
<term>
<option>lxc.aa_allow_incomplete</option>
</term>
<listitem>
<para>
Apparmor profiles are pathname based. Therefore many file
restrictions require mount restrictions to be effective against
a determined attacker. However, these mount restrictions are not
yet implemented in the upstream kernel. Without the mount
restrictions, the apparmor profiles still protect against accidental
damager.
</para>
<para>
If this flag is 0 (default), then the container will not be
started if the kernel lacks the apparmor mount features, so that a
regression after a kernel upgrade will be detected. To start the
container under partial apparmor protection, set this flag to 1.
</para>
</listitem>
</varlistentry>
</variablelist> </variablelist>
</refsect2> </refsect2>