mir/lxc
2
0
Fork 0
mirror of git://github.com/lxc/lxc synced 2025-09-01 05:48:28 +00:00
Code Issues Releases Wiki Activity

Merge pull request #1061 from stgraber/master

Browse Source 
More apparmor tweaks
This commit is contained in:
Serge Hallyn
2016-06-27 15:11:08 -05:00
committed by GitHub
parent b2a245c2b4 7f2b13275d
commit 42c6b8d809
2 changed files with 55 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
config/apparmor/abstractions/container-base
View File

@@ -93,18 +93,15 @@
# deny reads from debugfs # deny reads from debugfs
deny /sys/kernel/debug/{,**} rwklx, deny /sys/kernel/debug/{,**} rwklx,
# allow paths to be made shared, rshared, private or rprivate # allow paths to be made slave, shared, private or unbindable
mount options=(rw,shared) -> /, mount options=(rw,make-slave) -> **,
mount options=(rw,shared) -> /**, mount options=(rw,make-rslave) -> **,
mount options=(rw,make-shared) -> **,
mount options=(rw,rshared) -> /, mount options=(rw,make-rshared) -> **,
mount options=(rw,rshared) -> /**, mount options=(rw,make-private) -> **,
mount options=(rw,make-rprivate) -> **,
mount options=(rw,private) -> /, mount options=(rw,make-unbindable) -> **,
mount options=(rw,private) -> /**, mount options=(rw,make-runbindable) -> **,
mount options=(rw,rprivate) -> /,
mount options=(rw,rprivate) -> /**,
# allow bind-mounts of anything except /proc, /sys and /dev # allow bind-mounts of anything except /proc, /sys and /dev
mount options=(rw,bind) /[^spd]*{,/**}, mount options=(rw,bind) /[^spd]*{,/**},
@@ -124,6 +121,24 @@
mount options=(rw,bind) /sy[^s]*{,/**}, mount options=(rw,bind) /sy[^s]*{,/**},
mount options=(rw,bind) /sys?*{,/**}, mount options=(rw,bind) /sys?*{,/**},
# allow moving mounts except for /proc, /sys and /dev
mount options=(rw,move) /[^spd]*{,/**},
mount options=(rw,move) /d[^e]*{,/**},
mount options=(rw,move) /de[^v]*{,/**},
mount options=(rw,move) /dev/.[^l]*{,/**},
mount options=(rw,move) /dev/.l[^x]*{,/**},
mount options=(rw,move) /dev/.lx[^c]*{,/**},
mount options=(rw,move) /dev/.lxc?*{,/**},
mount options=(rw,move) /dev/[^.]*{,/**},
mount options=(rw,move) /dev?*{,/**},
mount options=(rw,move) /p[^r]*{,/**},
mount options=(rw,move) /pr[^o]*{,/**},
mount options=(rw,move) /pro[^c]*{,/**},
mount options=(rw,move) /proc?*{,/**},
mount options=(rw,move) /s[^y]*{,/**},
mount options=(rw,move) /sy[^s]*{,/**},
mount options=(rw,move) /sys?*{,/**},
# generated by: lxc-generate-aa-rules.py container-rules.base # generated by: lxc-generate-aa-rules.py container-rules.base
deny /proc/sys/[^kn]*{,/**} wklx, deny /proc/sys/[^kn]*{,/**} wklx,
deny /proc/sys/k[^e]*{,/**} wklx, deny /proc/sys/k[^e]*{,/**} wklx,

40
config/apparmor/abstractions/container-base.in
View File

@@ -93,18 +93,16 @@
# deny reads from debugfs # deny reads from debugfs
deny /sys/kernel/debug/{,**} rwklx, deny /sys/kernel/debug/{,**} rwklx,
# allow paths to be made shared, rshared, private or rprivate # allow paths to be made slave, shared, private or unbindable
mount options=(rw,shared) -> /, # FIXME: This currently doesn't work due to the apparmor parser treating those as allowing all mounts.
mount options=(rw,shared) -> /**, # mount options=(rw,make-slave) -> **,
# mount options=(rw,make-rslave) -> **,
mount options=(rw,rshared) -> /, # mount options=(rw,make-shared) -> **,
mount options=(rw,rshared) -> /**, # mount options=(rw,make-rshared) -> **,
# mount options=(rw,make-private) -> **,
mount options=(rw,private) -> /, # mount options=(rw,make-rprivate) -> **,
mount options=(rw,private) -> /**, # mount options=(rw,make-unbindable) -> **,
# mount options=(rw,make-runbindable) -> **,
mount options=(rw,rprivate) -> /,
mount options=(rw,rprivate) -> /**,
# allow bind-mounts of anything except /proc, /sys and /dev # allow bind-mounts of anything except /proc, /sys and /dev
mount options=(rw,bind) /[^spd]*{,/**}, mount options=(rw,bind) /[^spd]*{,/**},
@@ -124,3 +122,21 @@
mount options=(rw,bind) /sy[^s]*{,/**}, mount options=(rw,bind) /sy[^s]*{,/**},
mount options=(rw,bind) /sys?*{,/**}, mount options=(rw,bind) /sys?*{,/**},
# allow moving mounts except for /proc, /sys and /dev
mount options=(rw,move) /[^spd]*{,/**},
mount options=(rw,move) /d[^e]*{,/**},
mount options=(rw,move) /de[^v]*{,/**},
mount options=(rw,move) /dev/.[^l]*{,/**},
mount options=(rw,move) /dev/.l[^x]*{,/**},
mount options=(rw,move) /dev/.lx[^c]*{,/**},
mount options=(rw,move) /dev/.lxc?*{,/**},
mount options=(rw,move) /dev/[^.]*{,/**},
mount options=(rw,move) /dev?*{,/**},
mount options=(rw,move) /p[^r]*{,/**},
mount options=(rw,move) /pr[^o]*{,/**},
mount options=(rw,move) /pro[^c]*{,/**},
mount options=(rw,move) /proc?*{,/**},
mount options=(rw,move) /s[^y]*{,/**},
mount options=(rw,move) /sy[^s]*{,/**},
mount options=(rw,move) /sys?*{,/**},