Commits on Mar 20, 2018

1. Fix AppArmor not being applied to Exec processes …

   Exec processes do not automatically inherit AppArmor
   profiles from the container.
   
   This patch sets the AppArmor profile for the exec
   process.
   
   Before this change:
   
       apparmor_parser -q -r <<EOF
       #include <tunables/global>
       profile deny-write flags=(attach_disconnected) {
         #include <abstractions/base>
         file,
         network,
         deny /tmp/** w,
         capability,
       }
       EOF
   
       docker run -dit --security-opt "apparmor=deny-write" --name aa busybox
   
       docker exec aa sh -c 'mkdir /tmp/test'
       (no error)
   
   With this change applied:
   
       docker exec aa sh -c 'mkdir /tmp/test'
       mkdir: can't create directory '/tmp/test': Permission denied
   
   Signed-off-by: Sebastiaan van Stijn <[email protected]>
   (cherry picked from commit 8f3308ae10ec9ad0dd4edfb46fde53a0e1e19b34)
   Signed-off-by: Sebastiaan van Stijn <[email protected]>

   

   thaJeztah committed Mar 20, 2018
   Configuration menu

   • View commit details
   • Copy full SHA for d8bfd40
   • Browse repository at this point

   Copy the full SHA

   d8bfd40 View commit details

   Browse the repository at this point in the history