Re: [systemd-devel] [PATCH] Move apparmor code before the namespace setup

2014-10-29 Thread Michael Scherer
On Mon, Oct 27, 2014 at 11:20:53PM +0100, Lennart Poettering wrote: On Mon, 27.10.14 20:16, Michael Scherer (m...@zarb.org) wrote: On Mon, Oct 27, 2014 at 03:38:37PM +0100, Lennart Poettering wrote: On Sat, 11.10.14 21:57, m...@zarb.org (m...@zarb.org) wrote: From: Michael Scherer

Re: [systemd-devel] [PATCH] Move apparmor code before the namespace setup

2014-10-27 Thread Lennart Poettering
On Sat, 11.10.14 21:57, m...@zarb.org (m...@zarb.org) wrote: From: Michael Scherer m...@zarb.org Since apparmor need to access /proc to communicate with the kernel, any unit setting / as readonly will be unable to also use the AppArmorProfile setting, as found on debian bug 760526. A unit

Re: [systemd-devel] [PATCH] Move apparmor code before the namespace setup

2014-10-27 Thread Michael Scherer
On Mon, Oct 27, 2014 at 03:38:37PM +0100, Lennart Poettering wrote: On Sat, 11.10.14 21:57, m...@zarb.org (m...@zarb.org) wrote: From: Michael Scherer m...@zarb.org Since apparmor need to access /proc to communicate with the kernel, any unit setting / as readonly will be unable to also

Re: [systemd-devel] [PATCH] Move apparmor code before the namespace setup

2014-10-27 Thread Lennart Poettering
On Mon, 27.10.14 20:16, Michael Scherer (m...@zarb.org) wrote: On Mon, Oct 27, 2014 at 03:38:37PM +0100, Lennart Poettering wrote: On Sat, 11.10.14 21:57, m...@zarb.org (m...@zarb.org) wrote: From: Michael Scherer m...@zarb.org Since apparmor need to access /proc to communicate

Re: [systemd-devel] [PATCH] Move apparmor code before the namespace setup

2014-10-27 Thread Reindl Harald
Am 27.10.2014 um 23:20 schrieb Lennart Poettering: On Mon, 27.10.14 20:16, Michael Scherer (m...@zarb.org) wrote: On Mon, Oct 27, 2014 at 03:38:37PM +0100, Lennart Poettering wrote: On Sat, 11.10.14 21:57, m...@zarb.org (m...@zarb.org) wrote: From: Michael Scherer m...@zarb.org Since

[systemd-devel] [PATCH] Move apparmor code before the namespace setup

2014-10-24 Thread misc
From: Michael Scherer m...@zarb.org Since apparmor need to access /proc to communicate with the kernel, any unit setting / as readonly will be unable to also use the AppArmorProfile setting, as found on debian bug 760526. --- src/core/execute.c | 19 ++- 1 file changed, 10