[libvirt] [PATCHv3] Rework lxc apparmor profile

[Eric Blake]

On 07/15/2014 03:02 AM, Cédric Bosdonnat wrote:
> Rework the apparmor lxc profile abstraction to mimic ubuntu's container-default.
> This profile allows quite a lot, but strives to restrict access to
> dangerous resources.
> 
> Removing the explicit authorizations to bash, systemd and cron files,
> forces them to keep the lxc profile for all applications inside the
> container. PUx permissions where leading to running systemd (and others
> tasks) unconfined.
> 
> Put the generic files, network and capabilities restrictions directly
> in the TEMPLATE.lxc: this way, users can restrict them on a per
> container basis.
> ---
>  Diff to v2:
>    * Fixed missing goto cleanup

Will push shortly, based on the ack given here:
https://www.redhat.com/archives/libvir-list/2014-July/msg00745.html

-- 
Eric Blake   eblake redhat com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 604 bytes
Desc: OpenPGP digital signature
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20140715/633ff996/attachment-0001.sig>