From 59fe77bfa638001cbe9af386f350d6e0dbb23398 Mon Sep 17 00:00:00 2001 From: Michael Crosby Date: Fri, 2 May 2014 11:14:24 -0700 Subject: [PATCH] Don't restrict lxc because of apparmor We don't have the flexibility to do extra things with lxc because it is a black box and most fo the magic happens before we get a chance to interact with it in dockerinit. Docker-DCO-1.1-Signed-off-by: Michael Crosby (github: crosbymichael) --- daemon/execdriver/lxc/driver.go | 6 ------ pkg/libcontainer/nsinit/init.go | 2 +- pkg/libcontainer/security/restrict/restrict.go | 4 ++-- 3 files changed, 3 insertions(+), 9 deletions(-) diff --git a/daemon/execdriver/lxc/driver.go b/daemon/execdriver/lxc/driver.go index 92a79ff5a5..2c06211c0d 100644 --- a/daemon/execdriver/lxc/driver.go +++ b/daemon/execdriver/lxc/driver.go @@ -16,7 +16,6 @@ import ( "github.com/dotcloud/docker/daemon/execdriver" "github.com/dotcloud/docker/pkg/cgroups" "github.com/dotcloud/docker/pkg/label" - "github.com/dotcloud/docker/pkg/libcontainer/security/restrict" "github.com/dotcloud/docker/pkg/system" "github.com/dotcloud/docker/utils" ) @@ -34,11 +33,6 @@ func init() { if err := setupNetworking(args); err != nil { return err } - if !args.Privileged { - if err := restrict.Restrict(); err != nil { - return err - } - } if err := setupCapabilities(args); err != nil { return err } diff --git a/pkg/libcontainer/nsinit/init.go b/pkg/libcontainer/nsinit/init.go index 22345f603f..a123757708 100644 --- a/pkg/libcontainer/nsinit/init.go +++ b/pkg/libcontainer/nsinit/init.go @@ -79,7 +79,7 @@ func Init(container *libcontainer.Container, uncleanRootfs, consolePath string, return fmt.Errorf("set process label %s", err) } if container.Context["restrictions"] != "" { - if err := restrict.Restrict(); err != nil { + if err := restrict.Restrict("proc", "sys"); err != nil { return err } } diff --git a/pkg/libcontainer/security/restrict/restrict.go b/pkg/libcontainer/security/restrict/restrict.go index cfff09f512..e1296b1d7f 100644 --- a/pkg/libcontainer/security/restrict/restrict.go +++ b/pkg/libcontainer/security/restrict/restrict.go @@ -11,9 +11,9 @@ import ( // This has to be called while the container still has CAP_SYS_ADMIN (to be able to perform mounts). // However, afterwards, CAP_SYS_ADMIN should be dropped (otherwise the user will be able to revert those changes). -func Restrict() error { +func Restrict(mounts ...string) error { // remount proc and sys as readonly - for _, dest := range []string{"proc", "sys"} { + for _, dest := range mounts { if err := system.Mount("", dest, "", syscall.MS_REMOUNT|syscall.MS_RDONLY, ""); err != nil { return fmt.Errorf("unable to remount %s readonly: %s", dest, err) }