mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-09-02 15:25:27 +00:00
Code Issues Releases Wiki Activity

Update how to setup a policy namespace for containers

John Johansen
2019-05-02 22:18:59 +00:00
parent 9143a398b9
commit 25ce732a78
1 changed files with 13 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
how-to-setup-a-policy-namespace-for-containers.md

@@ -2,6 +2,11 @@
bla bla bla, dependent on apparmor version and kernel version bla bla bla, dependent on apparmor version and kernel version
# Base Requirements
* [A kernel that supports LSM stacking](how-to-setup-a-policy-namespace-for-containers#Stacking-Kernel-Requirements)
* [Authority to create an apparmor policy namespace](how-to-setup-a-policy-namespace-for-containers#Authority-to-create-a-policy-namespace)
# snappy # snappy
Is not required for snappy. Snappy applications don't load their own policy, snapd does it for them. Is not required for snappy. Snappy applications don't load their own policy, snapd does it for them.
@@ -19,11 +24,10 @@ need the display lsm set
Lxd already supports creating apparmor child namespaces. Lxd already supports creating apparmor child namespaces.
Nesting requirement with user namespaces Nesting requirement with user namespaces
# Stacking Kernel Requirements
Caveat: Audit subsystem is not namespaced # Authority to create a policy namespace
## Authority to create a policy namespace Depends on apparmor and kernel versions
* kernels up to ??? require capability MAC_ADMIN in the user namespace. * kernels up to ??? require capability MAC_ADMIN in the user namespace.
@@ -31,6 +35,12 @@ Caveat: Audit subsystem is not namespaced
* kernels ??? add the ability for users to create/admin their own policy. * kernels ??? add the ability for users to create/admin their own policy.
# Stacking Kernel Requirements
Caveat: Audit subsystem is not namespaced
## Nesting Requirement ## Nesting Requirement
if apparmor policy namespaces are used in conjunction with user namespaces. There is a nesting limit. if apparmor policy namespaces are used in conjunction with user namespaces. There is a nesting limit.