Home / server / Questions / 976828
In Process
SledgehammerPL
Asked: 2019-07-27 04:24:42 +0800 CST

lxc with apparmor - where should be defined profiles

  • 772

I created /root/example.sh from here at the host, and with aa-genprof denied it.

# ./example.sh
This is an apparmor example.
./example.sh: line 5: /usr/bin/touch: Permission denied
File created
./example.sh: line 8: /bin/rm: Permission denied
File deleted

great - it works!

But if i copy it into containers (at the same /root folder) it works normal (without any restrictions).

First think is to install apparmor at container, but wait!!! some of processes inside containers logs into host syslog (postdrop is denied to access dynamicmaps.cd.d - and this postdrop is running in container!).

So somehow I have to add example.sh into host apparmor.d, and it should also affect all containers... But how?

lxc

0 Answers