NuKVM/libvirt
3
0
Fork 0
mirror of https://github.com/libvirt/libvirt.git synced 2025-02-25 18:55:26 -06:00
Code Issues Packages Projects Releases Wiki Activity

add support for apparmor in lxc-enter-namespace

Browse Source
This commit is contained in:
Cédric Bosdonnat 2014-03-03 11:26:45 +01:00 committed by Daniel P. Berrange
parent 500b2e9655
commit ef7dc7d429
2 changed files with 22 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
examples/apparmor/libvirt-lxc
View File

@ -2,6 +2,13 @@
#include <abstractions/base> #include <abstractions/base>
# Needed for lxc-enter-namespace
capability sys_admin,
capability sys_chroot,
# Added for lxc-enter-namespace --cmd /bin/bash
/bin/bash PUx,
/usr/sbin/cron PUx, /usr/sbin/cron PUx,
/usr/lib/systemd/systemd PUx, /usr/lib/systemd/systemd PUx,

15
src/libvirt-lxc.c
View File

@ -33,6 +33,9 @@
#ifdef WITH_SELINUX #ifdef WITH_SELINUX
# include <selinux/selinux.h> # include <selinux/selinux.h>
#endif #endif
#ifdef WITH_APPARMOR
# include <sys/apparmor.h>
#endif
#define VIR_FROM_THIS VIR_FROM_NONE #define VIR_FROM_THIS VIR_FROM_NONE
@ -239,6 +242,18 @@ virDomainLxcEnterSecurityLabel(virSecurityModelPtr model,
virReportError(VIR_ERR_ARGUMENT_UNSUPPORTED, "%s", virReportError(VIR_ERR_ARGUMENT_UNSUPPORTED, "%s",
_("Support for SELinux is not enabled")); _("Support for SELinux is not enabled"));
goto error; goto error;
#endif
} else if (STREQ(model->model, "apparmor")) {
#ifdef WITH_APPARMOR
if (aa_change_profile(label->label) < 0) {
virReportSystemError(errno, _("error changing profile to %s"),
label->label);
goto error;
}
#else
virReportError(VIR_ERR_ARGUMENT_UNSUPPORTED, "%s",
_("Support for AppArmor is not enabled"));
goto error;
#endif #endif
} else { } else {
virReportError(VIR_ERR_ARGUMENT_UNSUPPORTED, virReportError(VIR_ERR_ARGUMENT_UNSUPPORTED,