Hi,
I have a patch (core patch appended fyi, see
lp:~serge-hallyn/ubuntu/precise/lxc/lxc-aa for the full set of package
changes) to make lxc-start switch to a apparmor profile specified in the
container config (with lxc.aa_profile). Making this support selinux and
smack as well should be pretty trivial - but testing that properly will
not be.
After April I will extend this patch to support selinux and smack
(and test it) and push a patch upstream. In the meantime, I intend
to carry this as a delta in ubuntu. However, if someone has the time
and inclination to work on it beforehand, that's great. Comments of
course are appreciated.
thanks,
-serge
Description: support per-container apparmor profiles
It doesn't yet support selinux or smack.
Author: Serge Hallyn <serge.hal...@canonical.com>
Forwarded: no
Index: lxc-aa/src/lxc/conf.h
===================================================================
--- lxc-aa.orig/src/lxc/conf.h 2012-03-18 22:32:12.425570000 -0500
+++ lxc-aa/src/lxc/conf.h 2012-03-18 22:40:07.198440851 -0500
@@ -193,6 +193,7 @@
* @tty_info : tty data
* @console : console data
* @ttydir : directory (under /dev) in which to create console and ttys
+ * @aa_profile : apparmor profile to switch to
*/
struct lxc_conf {
char *fstab;
@@ -211,6 +212,7 @@
struct lxc_rootfs rootfs;
char *ttydir;
int close_all_fds;
+ char *aa_profile;
};
/*
Index: lxc-aa/src/lxc/start.c
===================================================================
--- lxc-aa.orig/src/lxc/start.c 2012-03-18 22:32:12.425570000 -0500
+++ lxc-aa/src/lxc/start.c 2012-03-19 10:05:05.549360259 -0500
@@ -546,6 +546,17 @@
close(handler->sigfd);
+#define AA_DEF_PROFILE "lxc-container-default"
+
+ if (!handler->conf->aa_profile)
+ handler->conf->aa_profile = AA_DEF_PROFILE;
+
+ if (aa_change_profile(handler->conf->aa_profile) < 0) {
+ SYSERROR("failed to change apparmor profile to %s\n",
handler->conf->aa_profile);
+ return -1;
+ }
+ INFO("changed apparmor profile to %s\n", handler->conf->aa_profile);
+
/* after this call, we are in error because this
* ops should not return as it execs */
if (handler->ops->start(handler, handler->data))
Index: lxc-aa/src/lxc/conf.c
===================================================================
--- lxc-aa.orig/src/lxc/conf.c 2012-03-18 22:32:12.425570000 -0500
+++ lxc-aa/src/lxc/conf.c 2012-03-18 22:40:36.754587413 -0500
@@ -1523,6 +1523,7 @@
lxc_list_init(&new->network);
lxc_list_init(&new->mount_list);
lxc_list_init(&new->caps);
+ new->aa_profile = NULL;
return new;
}
Index: lxc-aa/src/lxc/confile.c
===================================================================
--- lxc-aa.orig/src/lxc/confile.c 2012-03-18 22:32:12.425570000 -0500
+++ lxc-aa/src/lxc/confile.c 2012-03-18 22:49:44.054169567 -0500
@@ -48,6 +48,7 @@
static int config_pts(const char *, char *, struct lxc_conf *);
static int config_tty(const char *, char *, struct lxc_conf *);
static int config_ttydir(const char *, char *, struct lxc_conf *);
+static int config_aa_profile(const char *, char *, struct lxc_conf *);
static int config_cgroup(const char *, char *, struct lxc_conf *);
static int config_mount(const char *, char *, struct lxc_conf *);
static int config_rootfs(const char *, char *, struct lxc_conf *);
@@ -82,6 +83,7 @@
{ "lxc.pts", config_pts },
{ "lxc.tty", config_tty },
{ "lxc.devttydir", config_ttydir },
+ { "lxc.aa_profile", config_aa_profile },
{ "lxc.cgroup", config_cgroup },
{ "lxc.mount", config_mount },
{ "lxc.rootfs.mount", config_rootfs_mount },
@@ -571,6 +573,24 @@
return 0;
}
+
+static int config_aa_profile(const char *key, char *value,
+ struct lxc_conf *lxc_conf)
+{
+ char *path;
+
+ if (!value || strlen(value) == 0)
+ return 0;
+ path = strdup(value);
+ if (!path) {
+ SYSERROR("failed to strdup '%s': %m", value);
+ return -1;
+ }
+
+ lxc_conf->aa_profile = path;
+
+ return 0;
+}
static int config_cgroup(const char *key, char *value, struct lxc_conf
*lxc_conf)
{
Index: lxc-aa/src/lxc/Makefile.am
===================================================================
--- lxc-aa.orig/src/lxc/Makefile.am 2012-03-18 22:32:12.425570000 -0500
+++ lxc-aa/src/lxc/Makefile.am 2012-03-19 08:58:45.969626599 -0500
@@ -60,7 +60,7 @@
-shared \
-Wl,-soname,liblxc.so.$(firstword $(subst ., ,$(VERSION)))
-liblxc_so_LDADD = -lutil $(CAP_LIBS)
+liblxc_so_LDADD = -lutil $(CAP_LIBS) -lapparmor
bin_SCRIPTS = \
lxc-ps \
@@ -95,7 +95,7 @@
lxc-init
AM_LDFLAGS=-Wl,-E -Wl,-rpath -Wl,$(libdir)
-LDADD=liblxc.so @CAP_LIBS@
+LDADD=liblxc.so @CAP_LIBS@ -lapparmor
lxc_attach_SOURCES = lxc_attach.c
lxc_cgroup_SOURCES = lxc_cgroup.c
Index: lxc-aa/src/lxc/Makefile.in
===================================================================
--- lxc-aa.orig/src/lxc/Makefile.in 2012-03-18 22:32:12.425570000 -0500
+++ lxc-aa/src/lxc/Makefile.in 2012-03-19 08:59:01.873705454 -0500
@@ -368,7 +368,7 @@
-shared \
-Wl,-soname,liblxc.so.$(firstword $(subst ., ,$(VERSION)))
-liblxc_so_LDADD = -lutil $(CAP_LIBS)
+liblxc_so_LDADD = -lutil $(CAP_LIBS) -lapparmor
bin_SCRIPTS = \
lxc-ps \
lxc-netstat \
@@ -382,7 +382,7 @@
lxc-destroy
AM_LDFLAGS = -Wl,-E -Wl,-rpath -Wl,$(libdir)
-LDADD = liblxc.so @CAP_LIBS@
+LDADD = liblxc.so @CAP_LIBS@ -lapparmor
lxc_attach_SOURCES = lxc_attach.c
lxc_cgroup_SOURCES = lxc_cgroup.c
lxc_checkpoint_SOURCES = lxc_checkpoint.c
------------------------------------------------------------------------------
This SF email is sponsosred by:
Try Windows Azure free for 90 days Click Here
http://p.sf.net/sfu/sfd2d-msazure
_______________________________________________
Lxc-users mailing list
Lxc-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/lxc-users
