kotovalexarian-likes-github/moby--moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Code Releases Activity

Merge pull request #5556 from crosbymichael/no-restrict-lxc

Browse source 
Don't restrict lxc because of apparmor
This commit is contained in:
Michael Crosby 2014-05-02 17:20:27 -07:00
commit 3a1f0dedc7
3 changed files with 3 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
daemon/execdriver/lxc/driver.go
View file

@ -16,7 +16,6 @@ import (
"github.com/dotcloud/docker/daemon/execdriver"
"github.com/dotcloud/docker/pkg/cgroups"
"github.com/dotcloud/docker/pkg/label"
"github.com/dotcloud/docker/pkg/libcontainer/security/restrict"
"github.com/dotcloud/docker/pkg/system"
"github.com/dotcloud/docker/utils"
)
@ -34,11 +33,6 @@ func init() {
if err := setupNetworking(args); err != nil {
return err
}
if !args.Privileged {
if err := restrict.Restrict(); err != nil {
return err
}
}
if err := setupCapabilities(args); err != nil {
return err
}

2
pkg/libcontainer/nsinit/init.go
View file

@ -79,7 +79,7 @@ func Init(container *libcontainer.Container, uncleanRootfs, consolePath string,
return fmt.Errorf("set process label %s", err)
}
if container.Context["restrictions"] != "" {
if err := restrict.Restrict(); err != nil {
if err := restrict.Restrict("proc", "sys"); err != nil {
return err
}
}

4
pkg/libcontainer/security/restrict/restrict.go
View file

@ -11,9 +11,9 @@ import (
// This has to be called while the container still has CAP_SYS_ADMIN (to be able to perform mounts).
// However, afterwards, CAP_SYS_ADMIN should be dropped (otherwise the user will be able to revert those changes).
func Restrict() error {
func Restrict(mounts ...string) error {
// remount proc and sys as readonly
for _, dest := range []string{"proc", "sys"} {
for _, dest := range mounts {
if err := system.Mount("", dest, "", syscall.MS_REMOUNT|syscall.MS_RDONLY, ""); err != nil {
return fmt.Errorf("unable to remount %s readonly: %s", dest, err)
}