[libvirt] [PATCHv3] Rework lxc apparmor profile

Eric Blake eblake at redhat.com
Tue Jul 15 16:48:38 UTC 2014

On 07/15/2014 03:02 AM, Cédric Bosdonnat wrote:
> Rework the apparmor lxc profile abstraction to mimic ubuntu's container-default.
> This profile allows quite a lot, but strives to restrict access to
> dangerous resources.
> Removing the explicit authorizations to bash, systemd and cron files,
> forces them to keep the lxc profile for all applications inside the
> container. PUx permissions where leading to running systemd (and others
> tasks) unconfined.
> Put the generic files, network and capabilities restrictions directly
> in the TEMPLATE.lxc: this way, users can restrict them on a per
> container basis.
> ---
>  Diff to v2:
>    * Fixed missing goto cleanup

Will push shortly, based on the ack given here:

Eric Blake   eblake redhat com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 604 bytes
Desc: OpenPGP digital signature
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20140715/633ff996/attachment-0001.sig>

More information about the libvir-list mailing list