/proc/sys/kernel/sem* and /proc/sys/kernel/msg* are ipc sysctls which are properly namespaced. Allow writes to them from containers.
Reported-by: Dan Kegel <[email protected]> Signed-off-by: Serge Hallyn <[email protected]> --- config/apparmor/abstractions/container-base | 9 +++++++-- config/apparmor/container-rules | 9 +++++++-- config/apparmor/container-rules.base | 2 ++ 3 files changed, 16 insertions(+), 4 deletions(-) diff --git a/config/apparmor/abstractions/container-base b/config/apparmor/abstractions/container-base index c109baa..71e9348 100644 --- a/config/apparmor/abstractions/container-base +++ b/config/apparmor/abstractions/container-base @@ -55,7 +55,7 @@ deny /proc/sys/ker[^n]*{,/**} wklx, deny /proc/sys/kern[^e]*{,/**} wklx, deny /proc/sys/kerne[^l]*{,/**} wklx, - deny /proc/sys/kernel/[^shd]*{,/**} wklx, + deny /proc/sys/kernel/[^smhd]*{,/**} wklx, deny /proc/sys/kernel/d[^o]*{,/**} wklx, deny /proc/sys/kernel/do[^m]*{,/**} wklx, deny /proc/sys/kernel/dom[^a]*{,/**} wklx, @@ -74,7 +74,12 @@ deny /proc/sys/kernel/hostna[^m]*{,/**} wklx, deny /proc/sys/kernel/hostnam[^e]*{,/**} wklx, deny /proc/sys/kernel/hostname?*{,/**} wklx, - deny /proc/sys/kernel/s[^h]*{,/**} wklx, + deny /proc/sys/kernel/m[^s]*{,/**} wklx, + deny /proc/sys/kernel/ms[^g]*{,/**} wklx, + deny /proc/sys/kernel/msg*/** wklx, + deny /proc/sys/kernel/s[^he]*{,/**} wklx, + deny /proc/sys/kernel/se[^m]*{,/**} wklx, + deny /proc/sys/kernel/sem*/** wklx, deny /proc/sys/kernel/sh[^m]*{,/**} wklx, deny /proc/sys/kernel/shm*/** wklx, deny /proc/sys/kernel?*{,/**} wklx, diff --git a/config/apparmor/container-rules b/config/apparmor/container-rules index 2c8c0b4..ea5c408 100644 --- a/config/apparmor/container-rules +++ b/config/apparmor/container-rules @@ -5,7 +5,7 @@ deny /proc/sys/ker[^n]*{,/**} wklx, deny /proc/sys/kern[^e]*{,/**} wklx, deny /proc/sys/kerne[^l]*{,/**} wklx, - deny /proc/sys/kernel/[^shd]*{,/**} wklx, + deny /proc/sys/kernel/[^smhd]*{,/**} wklx, deny /proc/sys/kernel/d[^o]*{,/**} wklx, deny /proc/sys/kernel/do[^m]*{,/**} wklx, deny /proc/sys/kernel/dom[^a]*{,/**} wklx, @@ -24,7 +24,12 @@ deny /proc/sys/kernel/hostna[^m]*{,/**} wklx, deny /proc/sys/kernel/hostnam[^e]*{,/**} wklx, deny /proc/sys/kernel/hostname?*{,/**} wklx, - deny /proc/sys/kernel/s[^h]*{,/**} wklx, + deny /proc/sys/kernel/m[^s]*{,/**} wklx, + deny /proc/sys/kernel/ms[^g]*{,/**} wklx, + deny /proc/sys/kernel/msg*/** wklx, + deny /proc/sys/kernel/s[^he]*{,/**} wklx, + deny /proc/sys/kernel/se[^m]*{,/**} wklx, + deny /proc/sys/kernel/sem*/** wklx, deny /proc/sys/kernel/sh[^m]*{,/**} wklx, deny /proc/sys/kernel/shm*/** wklx, deny /proc/sys/kernel?*{,/**} wklx, diff --git a/config/apparmor/container-rules.base b/config/apparmor/container-rules.base index 615f015..a657481 100644 --- a/config/apparmor/container-rules.base +++ b/config/apparmor/container-rules.base @@ -8,6 +8,8 @@ allow /sys/devices/virtual/net/** allow /sys/class/net/** block /proc/sys allow /proc/sys/kernel/shm* +allow /proc/sys/kernel/sem* +allow /proc/sys/kernel/msg* allow /proc/sys/kernel/hostname allow /proc/sys/kernel/domainname allow /proc/sys/net/** -- 1.9.1 _______________________________________________ lxc-devel mailing list [email protected] http://lists.linuxcontainers.org/listinfo/lxc-devel
