Works here, thanks! - Dan
On Tue, Apr 29, 2014 at 2:13 PM, Stéphane Graber <[email protected]> wrote: > On Tue, Apr 29, 2014 at 08:02:32PM +0000, Serge Hallyn wrote: >> /proc/sys/kernel/sem* and /proc/sys/kernel/msg* are ipc sysctls >> which are properly namespaced. Allow writes to them from >> containers. >> >> Reported-by: Dan Kegel <[email protected]> >> Signed-off-by: Serge Hallyn <[email protected]> > > Acked-by: Stéphane Graber <[email protected]> > >> --- >> config/apparmor/abstractions/container-base | 9 +++++++-- >> config/apparmor/container-rules | 9 +++++++-- >> config/apparmor/container-rules.base | 2 ++ >> 3 files changed, 16 insertions(+), 4 deletions(-) >> >> diff --git a/config/apparmor/abstractions/container-base >> b/config/apparmor/abstractions/container-base >> index c109baa..71e9348 100644 >> --- a/config/apparmor/abstractions/container-base >> +++ b/config/apparmor/abstractions/container-base >> @@ -55,7 +55,7 @@ >> deny /proc/sys/ker[^n]*{,/**} wklx, >> deny /proc/sys/kern[^e]*{,/**} wklx, >> deny /proc/sys/kerne[^l]*{,/**} wklx, >> - deny /proc/sys/kernel/[^shd]*{,/**} wklx, >> + deny /proc/sys/kernel/[^smhd]*{,/**} wklx, >> deny /proc/sys/kernel/d[^o]*{,/**} wklx, >> deny /proc/sys/kernel/do[^m]*{,/**} wklx, >> deny /proc/sys/kernel/dom[^a]*{,/**} wklx, >> @@ -74,7 +74,12 @@ >> deny /proc/sys/kernel/hostna[^m]*{,/**} wklx, >> deny /proc/sys/kernel/hostnam[^e]*{,/**} wklx, >> deny /proc/sys/kernel/hostname?*{,/**} wklx, >> - deny /proc/sys/kernel/s[^h]*{,/**} wklx, >> + deny /proc/sys/kernel/m[^s]*{,/**} wklx, >> + deny /proc/sys/kernel/ms[^g]*{,/**} wklx, >> + deny /proc/sys/kernel/msg*/** wklx, >> + deny /proc/sys/kernel/s[^he]*{,/**} wklx, >> + deny /proc/sys/kernel/se[^m]*{,/**} wklx, >> + deny /proc/sys/kernel/sem*/** wklx, >> deny /proc/sys/kernel/sh[^m]*{,/**} wklx, >> deny /proc/sys/kernel/shm*/** wklx, >> deny /proc/sys/kernel?*{,/**} wklx, >> diff --git a/config/apparmor/container-rules >> b/config/apparmor/container-rules >> index 2c8c0b4..ea5c408 100644 >> --- a/config/apparmor/container-rules >> +++ b/config/apparmor/container-rules >> @@ -5,7 +5,7 @@ >> deny /proc/sys/ker[^n]*{,/**} wklx, >> deny /proc/sys/kern[^e]*{,/**} wklx, >> deny /proc/sys/kerne[^l]*{,/**} wklx, >> - deny /proc/sys/kernel/[^shd]*{,/**} wklx, >> + deny /proc/sys/kernel/[^smhd]*{,/**} wklx, >> deny /proc/sys/kernel/d[^o]*{,/**} wklx, >> deny /proc/sys/kernel/do[^m]*{,/**} wklx, >> deny /proc/sys/kernel/dom[^a]*{,/**} wklx, >> @@ -24,7 +24,12 @@ >> deny /proc/sys/kernel/hostna[^m]*{,/**} wklx, >> deny /proc/sys/kernel/hostnam[^e]*{,/**} wklx, >> deny /proc/sys/kernel/hostname?*{,/**} wklx, >> - deny /proc/sys/kernel/s[^h]*{,/**} wklx, >> + deny /proc/sys/kernel/m[^s]*{,/**} wklx, >> + deny /proc/sys/kernel/ms[^g]*{,/**} wklx, >> + deny /proc/sys/kernel/msg*/** wklx, >> + deny /proc/sys/kernel/s[^he]*{,/**} wklx, >> + deny /proc/sys/kernel/se[^m]*{,/**} wklx, >> + deny /proc/sys/kernel/sem*/** wklx, >> deny /proc/sys/kernel/sh[^m]*{,/**} wklx, >> deny /proc/sys/kernel/shm*/** wklx, >> deny /proc/sys/kernel?*{,/**} wklx, >> diff --git a/config/apparmor/container-rules.base >> b/config/apparmor/container-rules.base >> index 615f015..a657481 100644 >> --- a/config/apparmor/container-rules.base >> +++ b/config/apparmor/container-rules.base >> @@ -8,6 +8,8 @@ allow /sys/devices/virtual/net/** >> allow /sys/class/net/** >> block /proc/sys >> allow /proc/sys/kernel/shm* >> +allow /proc/sys/kernel/sem* >> +allow /proc/sys/kernel/msg* >> allow /proc/sys/kernel/hostname >> allow /proc/sys/kernel/domainname >> allow /proc/sys/net/** >> -- >> 1.9.1 >> >> _______________________________________________ >> lxc-devel mailing list >> [email protected] >> http://lists.linuxcontainers.org/listinfo/lxc-devel > > -- > Stéphane Graber > Ubuntu developer > http://www.ubuntu.com _______________________________________________ lxc-devel mailing list [email protected] http://lists.linuxcontainers.org/listinfo/lxc-devel
