Merge pull request #5556 from crosbymichael/no-restrict-lxc

Don't restrict lxc because of apparmor
This commit is contained in:
Michael Crosby 2014-05-02 17:20:27 -07:00
commit 3a1f0dedc7
3 changed files with 3 additions and 9 deletions

View file

@ -16,7 +16,6 @@ import (
"github.com/dotcloud/docker/daemon/execdriver"
"github.com/dotcloud/docker/pkg/cgroups"
"github.com/dotcloud/docker/pkg/label"
"github.com/dotcloud/docker/pkg/libcontainer/security/restrict"
"github.com/dotcloud/docker/pkg/system"
"github.com/dotcloud/docker/utils"
)
@ -34,11 +33,6 @@ func init() {
if err := setupNetworking(args); err != nil {
return err
}
if !args.Privileged {
if err := restrict.Restrict(); err != nil {
return err
}
}
if err := setupCapabilities(args); err != nil {
return err
}

View file

@ -79,7 +79,7 @@ func Init(container *libcontainer.Container, uncleanRootfs, consolePath string,
return fmt.Errorf("set process label %s", err)
}
if container.Context["restrictions"] != "" {
if err := restrict.Restrict(); err != nil {
if err := restrict.Restrict("proc", "sys"); err != nil {
return err
}
}

View file

@ -11,9 +11,9 @@ import (
// This has to be called while the container still has CAP_SYS_ADMIN (to be able to perform mounts).
// However, afterwards, CAP_SYS_ADMIN should be dropped (otherwise the user will be able to revert those changes).
func Restrict() error {
func Restrict(mounts ...string) error {
// remount proc and sys as readonly
for _, dest := range []string{"proc", "sys"} {
for _, dest := range mounts {
if err := system.Mount("", dest, "", syscall.MS_REMOUNT|syscall.MS_RDONLY, ""); err != nil {
return fmt.Errorf("unable to remount %s readonly: %s", dest, err)
}