Cédric Bosdonnat 9265f8ab67 Rework lxc apparmor profile ... Rework the apparmor lxc profile abstraction to mimic ubuntu's container-default. This profile allows quite a lot, but strives to restrict access to dangerous resources. Removing the explicit authorizations to bash, systemd and cron files, forces them to keep the lxc profile for all applications inside the container. PUx permissions where leading to running systemd (and others tasks) unconfined. Put the generic files, network and capabilities restrictions directly in the TEMPLATE.lxc: this way, users can restrict them on a per container basis.		2014-07-15 12:57:05 -06:00
..
security_apparmor.c	Rework lxc apparmor profile	2014-07-15 12:57:05 -06:00
security_apparmor.h	maint: fix up copyright notice inconsistencies	2012-09-20 16:30:55 -06:00
security_dac.c	virSecurityDeviceLabelDef: substitute 'norelabel' with 'relabel'	2014-07-11 10:36:02 +02:00
security_dac.h	security: use a single function to set DAC user and group	2013-10-29 06:55:09 -06:00
security_driver.c	Add virLogSource variables to all source files	2014-03-18 14:29:22 +00:00
security_driver.h	security: Introduce APIs to label single images	2014-07-09 10:38:56 +02:00
security_manager.c	virSecurityLabelDef: substitute 'norelabel' with 'relabel'	2014-07-11 10:35:58 +02:00
security_manager.h	security: Introduce APIs to label single images	2014-07-09 10:38:56 +02:00
security_nop.c	security: Introduce APIs to label single images	2014-07-09 10:38:56 +02:00
security_nop.h	maint: fix up copyright notice inconsistencies	2012-09-20 16:30:55 -06:00
security_selinux.c	virSecurityDeviceLabelDef: substitute 'norelabel' with 'relabel'	2014-07-11 10:36:02 +02:00
security_selinux.h	maint: fix up copyright notice inconsistencies	2012-09-20 16:30:55 -06:00
security_stack.c	security: Introduce APIs to label single images	2014-07-09 10:38:56 +02:00
security_stack.h	security: fix #endif comment in security_stack.h	2012-12-20 19:55:54 +01:00
virt-aa-helper.c	Rework lxc apparmor profile	2014-07-15 12:57:05 -06:00