External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-12-22 05:35:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

add support for apparmor in lxc-enter-namespace

Browse Source
This commit is contained in:
Cédric Bosdonnat 2014-03-03 11:26:45 +01:00 committed by Daniel P. Berrange
parent 500b2e9655
commit ef7dc7d429
2 changed files with 22 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
examples/apparmor/libvirt-lxc
View File

@ -2,6 +2,13 @@
#include <abstractions/base>
# Needed for lxc-enter-namespace
capability sys_admin,
capability sys_chroot,
# Added for lxc-enter-namespace --cmd /bin/bash
/bin/bash PUx,
/usr/sbin/cron PUx,
/usr/lib/systemd/systemd PUx,

15
src/libvirt-lxc.c
View File

@ -33,6 +33,9 @@
#ifdef WITH_SELINUX
# include <selinux/selinux.h>
#endif
#ifdef WITH_APPARMOR
# include <sys/apparmor.h>
#endif
#define VIR_FROM_THIS VIR_FROM_NONE
@ -239,6 +242,18 @@ virDomainLxcEnterSecurityLabel(virSecurityModelPtr model,
virReportError(VIR_ERR_ARGUMENT_UNSUPPORTED, "%s",
_("Support for SELinux is not enabled"));
goto error;
#endif
} else if (STREQ(model->model, "apparmor")) {
#ifdef WITH_APPARMOR
if (aa_change_profile(label->label) < 0) {
virReportSystemError(errno, _("error changing profile to %s"),
label->label);
goto error;
}
#else
virReportError(VIR_ERR_ARGUMENT_UNSUPPORTED, "%s",
_("Support for AppArmor is not enabled"));
goto error;
#endif
} else {
virReportError(VIR_ERR_ARGUMENT_UNSUPPORTED,