jasder
/
runc
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge pull request #5556 from crosbymichael/no-restrict-lxc 

Don't restrict lxc because of apparmor
This commit is contained in:
Michael Crosby 2014-05-02 17:20:27 -07:00
parent 78a83e35aa da71a207cb
commit 60ba7d05e9
2 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
nsinit/init.go
View File

@ -79,7 +79,7 @@ func Init(container *libcontainer.Container, uncleanRootfs, consolePath string,
return fmt.Errorf("set process label %s", err) return fmt.Errorf("set process label %s", err)
} }
if container.Context["restrictions"] != "" { if container.Context["restrictions"] != "" {
if err := restrict.Restrict(); err != nil { if err := restrict.Restrict("proc", "sys"); err != nil {
return err return err
} }
} }

4
security/restrict/restrict.go
View File

@ -11,9 +11,9 @@ import (
// This has to be called while the container still has CAP_SYS_ADMIN (to be able to perform mounts). // This has to be called while the container still has CAP_SYS_ADMIN (to be able to perform mounts).
// However, afterwards, CAP_SYS_ADMIN should be dropped (otherwise the user will be able to revert those changes). // However, afterwards, CAP_SYS_ADMIN should be dropped (otherwise the user will be able to revert those changes).
func Restrict() error { func Restrict(mounts ...string) error {
// remount proc and sys as readonly // remount proc and sys as readonly
for _, dest := range []string{"proc", "sys"} { for _, dest := range mounts {
if err := system.Mount("", dest, "", syscall.MS_REMOUNT|syscall.MS_RDONLY, ""); err != nil { if err := system.Mount("", dest, "", syscall.MS_REMOUNT|syscall.MS_RDONLY, ""); err != nil {
return fmt.Errorf("unable to remount %s readonly: %s", dest, err) return fmt.Errorf("unable to remount %s readonly: %s", dest, err)
} }