3cdfd8c531
Previously, only the v1 of the cgroup fs was being allowed by AppArmor and this were causing problems like the following one audit: type=1400 audit(1540571957.300:196): apparmor="DENIED" operation="mount" info="failed type match" error=-13 profile="lxc-container-default-cgns" name="/sys/fs/cgroup/unified/" pid=26738 comm="systemd" fstype="cgroup2" srcname="cgroup" flags="rw, nosuid, nodev, noexec" Change-Id: I7f6ac8af0bc1c7d9844ee0c3505b65894d3b7aa1
29 lines
1.1 KiB
Django/Jinja
29 lines
1.1 KiB
Django/Jinja
# Do not load this file. Rather, load /etc/apparmor.d/lxc-containers, which
|
|
# will source all profiles under /etc/apparmor.d/lxc
|
|
|
|
profile lxc-openstack flags=(attach_disconnected,mediate_deleted) {
|
|
#include <abstractions/lxc/container-base>
|
|
|
|
# allow standard blockdevtypes.
|
|
# The concern here is in-kernel superblock parsers bringing down the
|
|
# host with bad data. However, we continue to disallow proc, sys, securityfs,
|
|
# etc to nonstandard locations.
|
|
mount fstype=ext* -> /**,
|
|
mount fstype=nbd* -> /**,
|
|
mount fstype=xfs -> /**,
|
|
mount fstype=btrfs -> /**,
|
|
mount fstype=vfat* -> /**,
|
|
mount fstype=fuseblk -> /**,
|
|
mount fstype=nbd* -> /**,
|
|
mount fstype=nfs* -> /**,
|
|
mount fstype=rpc_pipefs,
|
|
mount fstype=devpts,
|
|
|
|
# allow System access.
|
|
mount fstype=cgroup -> /sys/fs/cgroup/**,
|
|
mount fstype=cgroup2 -> /sys/fs/cgroup/**,
|
|
mount fstype=proc -> {{ lxc_container_cache_path }}/**,
|
|
mount fstype=sysfs -> {{ lxc_container_cache_path }}/**,
|
|
mount options=(rw,bind) {{ lxc_container_cache_path }}/**/dev/shm/ -> {{ lxc_container_cache_path }}/**/run/shm/,
|
|
}
|