mirror of
https://git.proxmox.com/git/mirror_lxc
synced 2026-03-27 04:22:21 +00:00
108b88ce31
Newer kernels have added a new restriction: if /proc or /sys on the
host has files or non-empty directories which are over-mounted, and
there is no /proc which fully visible, then it assumes there is a
"security" reason for this. It prevents anyone in a non-initial user
namespace from creating a new proc or sysfs mount.
To work around this, this patch adds a new 'nesting.conf' which can be
lxc.include'd from a container configuration file. It adds a
non-overmounted mount of /proc and /sys under /dev/.lxc, so that the
kernel can see that we're not trying to *hide* things like /proc/uptime.
and /sys/devices/virtual/net. If the host adds this to the config file
for container w1, then container w1 will support unprivileged child
containers.
The nesting.conf file also sets the apparmor profile to the with-nesting
variant, since that is required anyway. This actually means that
supporting nesting isn't really more work than it used to be, just
different. Instead of adding
lxc.aa_profile = lxc-container-default-with-nesting
you now just need to
lxc.include = /usr/share/lxc/config/nesting.conf
(Look, fewer characters :)
Finally, in order to maintain the current apparmor protections on
proc and sys, we make /dev/.lxc/{proc,sys} non-read/writeable.
We don't need to be able to use them, we're just showing the
kernel what's what.
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
|
||
|---|---|---|
| .. | ||
| abstractions | ||
| profiles | ||
| container-rules | ||
| container-rules.base | ||
| lxc-containers | ||
| lxc-generate-aa-rules.py | ||
| Makefile.am | ||
| README | ||
| usr.bin.lxc-start | ||
The abstractions/container-base file is partially automatically generated. The two source files are container-rules.base and abstractions/container-base.in. If these file are updated, then 1. Generate a new container-rules file using ./lxc-generate-aa-rules.py container-rules.base > container-rules 2. Concatenate container-base.in with container-rules using cat abstractions/container-base.in container-rules > abstractions/container-base