Logo
Explore Help
Sign In
External/libvirt
1
0
Fork 0
You've already forked libvirt
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-02-19 10:01:28 +00:00
Code Issues Packages Projects Releases Wiki Activity
libvirt/examples/apparmor/TEMPLATE.lxc

16 lines
314 B
Plaintext
Raw Normal View History

Rework lxc apparmor profile Rework the apparmor lxc profile abstraction to mimic ubuntu's container-default. This profile allows quite a lot, but strives to restrict access to dangerous resources. Removing the explicit authorizations to bash, systemd and cron files, forces them to keep the lxc profile for all applications inside the container. PUx permissions where leading to running systemd (and others tasks) unconfined. Put the generic files, network and capabilities restrictions directly in the TEMPLATE.lxc: this way, users can restrict them on a per container basis.
2014-07-15 11:02:50 +02:00
#
# This profile is for the domain whose UUID matches this file.
#
#include <tunables/global>
profile LIBVIRT_TEMPLATE {
#include <abstractions/libvirt-lxc>
# Globally allows everything to run under this profile
# These can be narrowed depending on the container's use.
file,
capability,
network,
}
Reference in New Issue Copy Permalink
Powered by Gitea Version: 1.23.3 Page: 59ms Template: 3ms
English
Bahasa Indonesia Deutsch English Español Français Gaeilge Italiano Latviešu Magyar nyelv Nederlands Polski Português de Portugal Português do Brasil Suomi Svenska Türkçe Čeština Ελληνικά Български Русский Українська فارسی മലയാളം 日本語 简体中文 繁體中文(台灣) 繁體中文(香港) 한국어
Licenses API