On Tue, 20 Oct 2015, intrigeri wrote:
> Meta: I've been working for years to have the move to systemd not
> introduce a regression for us on the AppArmor front, and it currently
> does ⇒ I'd love to see essentially the regression fixed now for the
> *default* instance (that is, applying essentially the patch I've
> proposed on this bug applied, modulo it is now about
> [email protected]), and then deal separately with confining the
> non-default instances. In other words, let's first deal with
> regressions, then polish newly introduced features. What do you think?
I really dislike the fact that there now is feature disparity between
the default instance and the others. Hopefully we can fix this quickly.
>
> > Any idea how to best deal with apparmor here? Should we create one
> > /etc/apparmor.d/system_tor like system for each instance? Can we create
> > them at service start time or do we have to create them at instance
> > creation time?
>
> I've never worked with template units. I'll take a closer look later,
> but here's a first step.
>
> If AppArmorProfile= is applied _after_ ExecStartPre=, then we can
> probably use the latter to dynamically generate a per-instance profile
> from within a unit file itself. This would be ideal, and I think we
> should try that first.
That'd be great. Can profiles live outside of /etc/apparmor?
--
| .''`. ** Debian **
Peter Palfrader | : :' : The universal
https://www.palfrader.org/ | `. `' Operating System
| `- https://www.debian.org/
