proxmox-mirrors/mirror_lxc
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_lxc synced 2025-06-05 07:56:33 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Add lxc.aa_profile example to all templates

Browse Source 
LXC has optional apparmor support, default profile is lxc-container-default.
This change adds a commented "lxc.aa_profile = default" line to all templates,
uncommenting this will bypass apparmor for the container.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
This commit is contained in:
Stéphane Graber 2012-08-29 09:27:53 -07:00
parent 33f3de4eaa
commit f02ce27d4b
10 changed files with 36 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
templates/lxc-altlinux.in
View File

@ -245,6 +245,10 @@ lxc.tty = 4
lxc.pts = 1024
lxc.rootfs = $rootfs_path
lxc.mount = $config_path/fstab
# When using LXC with apparmor, uncomment the next line to run unconfined:
#lxc.aa_profile = unconfined
#networking
lxc.network.type = $lxc_network_type
lxc.network.flags = up

4
templates/lxc-archlinux.in
View File

@ -224,6 +224,10 @@ lxc.tty=4
lxc.pts=1024
lxc.rootfs=${rootfs_path}
lxc.mount=${config_path}/fstab
# When using LXC with apparmor, uncomment the next line to run unconfined:
#lxc.aa_profile = unconfined
#networking
lxc.network.type=${lxc_network_type}
lxc.network.flags=up

3
templates/lxc-busybox.in
View File

@ -233,6 +233,9 @@ lxc.utsname = $name
lxc.tty = 1
lxc.pts = 1
lxc.rootfs = $rootfs
# When using LXC with apparmor, uncomment the next line to run unconfined:
#lxc.aa_profile = unconfined
EOF
if [ -d "$rootfs/lib" ]; then

4
templates/lxc-debian.in
View File

@ -205,6 +205,10 @@ lxc.tty = 4
lxc.pts = 1024
lxc.rootfs = $rootfs
lxc.utsname = $hostname
# When using LXC with apparmor, uncomment the next line to run unconfined:
#lxc.aa_profile = unconfined
lxc.cgroup.devices.deny = a
# /dev/null and zero
lxc.cgroup.devices.allow = c 1:3 rwm

4
templates/lxc-fedora.in
View File

@ -237,6 +237,10 @@ lxc.tty = 4
lxc.pts = 1024
lxc.rootfs = $rootfs_path
lxc.mount = $config_path/fstab
# When using LXC with apparmor, uncomment the next line to run unconfined:
#lxc.aa_profile = unconfined
#networking
lxc.network.type = $lxc_network_type
lxc.network.flags = up

4
templates/lxc-lenny.in
View File

@ -183,6 +183,10 @@ lxc.tty = 4
lxc.pts = 1024
lxc.rootfs = $rootfs
lxc.cgroup.devices.deny = a
# When using LXC with apparmor, uncomment the next line to run unconfined:
#lxc.aa_profile = unconfined
# /dev/null and zero
lxc.cgroup.devices.allow = c 1:3 rwm
lxc.cgroup.devices.allow = c 1:5 rwm

3
templates/lxc-opensuse.in
View File

@ -262,6 +262,9 @@ lxc.pts = 1024
lxc.rootfs = $rootfs
lxc.mount = $path/fstab
# When using LXC with apparmor, uncomment the next line to run unconfined:
#lxc.aa_profile = unconfined
lxc.cgroup.devices.deny = a
# /dev/null and zero
lxc.cgroup.devices.allow = c 1:3 rwm

4
templates/lxc-sshd.in
View File

@ -101,6 +101,10 @@ cat <<EOF >> $path/config
lxc.utsname = $name
lxc.pts = 1024
lxc.rootfs = $rootfs
# When using LXC with apparmor, uncomment the next line to run unconfined:
#lxc.aa_profile = unconfined
lxc.mount.entry=/dev dev none ro,bind 0 0
lxc.mount.entry=/lib lib none ro,bind 0 0
lxc.mount.entry=/bin bin none ro,bind 0 0

3
templates/lxc-ubuntu-cloud.in
View File

@ -57,6 +57,9 @@ lxc.arch = $arch
lxc.cap.drop = sys_module mac_admin
lxc.pivotdir = lxc_putold
# When using LXC with apparmor, uncomment the next line to run unconfined:
#lxc.aa_profile = unconfined
lxc.cgroup.devices.deny = a
# Allow any mknod (but not using the node)
lxc.cgroup.devices.allow = c *:* m

3
templates/lxc-ubuntu.in
View File

@ -315,6 +315,9 @@ lxc.arch = $arch
lxc.cap.drop = sys_module mac_admin mac_override
lxc.pivotdir = lxc_putold
# When using LXC with apparmor, uncomment the next line to run unconfined:
#lxc.aa_profile = unconfined
lxc.cgroup.devices.deny = a
# Allow any mknod (but not using the node)
lxc.cgroup.devices.allow = c *:* m