Merge pull request #5556 from crosbymichael/no-restrict-lxc
Don't restrict lxc because of apparmor
This commit is contained in:
commit
3a1f0dedc7
3 changed files with 3 additions and 9 deletions
|
@ -16,7 +16,6 @@ import (
|
|||
"github.com/dotcloud/docker/daemon/execdriver"
|
||||
"github.com/dotcloud/docker/pkg/cgroups"
|
||||
"github.com/dotcloud/docker/pkg/label"
|
||||
"github.com/dotcloud/docker/pkg/libcontainer/security/restrict"
|
||||
"github.com/dotcloud/docker/pkg/system"
|
||||
"github.com/dotcloud/docker/utils"
|
||||
)
|
||||
|
@ -34,11 +33,6 @@ func init() {
|
|||
if err := setupNetworking(args); err != nil {
|
||||
return err
|
||||
}
|
||||
if !args.Privileged {
|
||||
if err := restrict.Restrict(); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
if err := setupCapabilities(args); err != nil {
|
||||
return err
|
||||
}
|
||||
|
|
|
@ -79,7 +79,7 @@ func Init(container *libcontainer.Container, uncleanRootfs, consolePath string,
|
|||
return fmt.Errorf("set process label %s", err)
|
||||
}
|
||||
if container.Context["restrictions"] != "" {
|
||||
if err := restrict.Restrict(); err != nil {
|
||||
if err := restrict.Restrict("proc", "sys"); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
|
|
@ -11,9 +11,9 @@ import (
|
|||
|
||||
// This has to be called while the container still has CAP_SYS_ADMIN (to be able to perform mounts).
|
||||
// However, afterwards, CAP_SYS_ADMIN should be dropped (otherwise the user will be able to revert those changes).
|
||||
func Restrict() error {
|
||||
func Restrict(mounts ...string) error {
|
||||
// remount proc and sys as readonly
|
||||
for _, dest := range []string{"proc", "sys"} {
|
||||
for _, dest := range mounts {
|
||||
if err := system.Mount("", dest, "", syscall.MS_REMOUNT|syscall.MS_RDONLY, ""); err != nil {
|
||||
return fmt.Errorf("unable to remount %s readonly: %s", dest, err)
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue