2
0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-30 22:05:27 +00:00

Update how to setup a policy namespace for containers

John Johansen
2019-05-15 20:38:26 +00:00
parent 674e610184
commit e76e1dac23

@@ -6,6 +6,43 @@ With LSM stacking it is possible to use multiple LSMs in conjunction with each o
At this time there are two [major and minor](how-to-setup-a-policy-namespace-for-containers#major-lsms-explained) LSMs. The following examples assume you are using a kernel that allows AppArmor to stack with another major LSM, the requirements for AppArmor to be able to stack with another major LSM are be different than say stacking smack with selinux, so what is outlined here may not work for other LSM combiniations.
This document is split into sections outlining a how to/example for different container situations and followed by more generic detailed information that can be used to adapt the examples to other situations.
# Assumptions
- apparmor userspace
- kernel
# Docker
## apparmor host, apparmor container
## apparmor host, smack container
## smack host, apparmor container
# LXD
## apparmor host, apparmor container
LXD natively supports using apparmor policy namespaces and policy bounded stacking as of ???.
## apparmor host, smack container
## smack host, apparmor container
# snappy
snappy will use apparmor policy if it is available
## apparmor host, apparmor container
## smack host, apparmor container
# flatpak
????
# Base Requirements